You can do this with regex:

on $*:snotice:/\52{3} (.+) \50.+\51 (.+)/: {
  inc %now 
  echo -a [ALERT] $regml(1) ( $address($regml(1),2) ) $regml(2)

But you have to be aware that not every network has the same server notice message for whois. They're somewhat different. So this code may need to be modified accordingly.