You can do this with regex:
on $*:snotice:/\52{3} (.+) \50.+\51 (.+)/: {
inc %now
echo -a [ALERT] $regml(1) ( $address($regml(1),2) ) $regml(2)
But you have to be aware that not every network has the same server notice message for whois. They're somewhat different. So this code may need to be modified accordingly.