Wrong raw event, methinks...
In my QueryGuard, I use 354, 314, 315 and 369, where two of them get the address, and two of them get the end of whois/whowas, so if a whois fails to get the address for some reason, it uses a whowas instead.
I believe what you need is raw 354 :>
ziv.
