Glonce

Researcher hijacks abandoned e164.arpa zone, logs 209,000 ENUM queries to military bases

securityThe Glonce editorsHacker News🔥81Glonce rating81Impact72Novelty78Relevance70Surprise82Players58Credibility82
Researcher hijacks abandoned e164.arpa zone, logs 209,000 ENUM queries to military bases

The write-up starts with e164.arpa, an early-2000s scheme called ENUM that lets phone carriers look up a number in DNS to see if it can be routed over cheap SIP/VoIP instead of the traditional phone network. A number is reversed and dotted, so +49 30 123456 becomes a lookup under .9.4.e164.arpa, the zone for all German numbers, controlled by DENIC the same way it controls .de. ENUM never caught on and has been effectively dead for years, though a handful of countries, Germany among them, still technically allow registering these domains; the author was the first to register one since 2019.

While scanning e164.arpa out of curiosity, the author found three country-code zones, 0.9.2.e164.arpa, 6.4.2.e164.arpa and 7.4.2.e164.arpa, delegated to the same two nameservers, ns6.icb.co.uk and ns.enum.org.uk. The first no longer resolved, meaning lookups fell back to the second, and that domain had simply expired. The author bought it for 5 euros and, with it, took control of DNS for all three zones. Reversed, the zone names are phone codes +290, +246 and +247: Saint Helena, the British Indian Ocean Territory (Diego Garcia) and Ascension Island, territories that also happen to hold the ccTLDs .sh, .io and .ac.

Controlling the DNS meant the author could answer any carrier's ENUM lookup for a number under those codes with a route to his own SIP server, accept the call, redial the real destination with a spoofed caller ID, and sit silently in the middle of the conversation while both sides believed the call was normal. He reported the exposure through multiple channels into the British government and got no response; his best guess is that someone at the defunct Internet Computer Bureau set the nameservers up more than a decade ago and the whole system was later forgotten. Q Misell, a researcher at the Max Planck Institute for Informatics, reported it on his behalf to RIPE, which manages e164.arpa, but RIPE also declined to act because delegations are governed by an ITU-T committee at the UN level.

Curious how much traffic the zones actually saw, the author turned on logging for Saint Helena's zone first and got zero queries in a full day, so he assumed nobody depended on any of it. He kept the domains, hosted his personal site and a Fediverse instance and a Matrix homeserver on them, and handed out subdomains to friends. Six months later, checking logs he had by then also enabled on the other two zones, he found hundreds of thousands of ENUM queries, almost all for the Diego Garcia and Ascension Island zones rather than Saint Helena, with source IPs mostly American. According to a footnote added once a friend, known online as 86dd, set up a second, non-logging nameserver for the zones, the totals were 100,170 queries for the Diego Garcia zone, 99,902 for Ascension Island's, and 9,133 for Saint Helena's; since that run captured only one of the two nameservers, the author estimates it represents about half the real total, putting the full count near 400,000 queries. Every one of those had been for calls to real phone numbers reaching, apparently, military bases on the two islands. His server answered every query with NXDOMAIN, so the calls were simply routed over the normal phone network rather than intercepted, and once he grasped what he was looking at he shut the logging down and deleted the log files.

Reporting the find a second time, this time to the UK's National Cyber Security Centre and mentioning that military bases were involved, finally got a real response, though the NCSC could not identify who had originally set up the abandoned delegation and ran into the same ITU-committee obstacle trying to fix it properly. A year on, the author still held the domain, though by then he had wiped the zone entirely so it returned NXDOMAIN for everything. On March 20, 2026, Iran fired ballistic missiles at Diego Garcia. Shortly afterward the NCSC arranged to take the domain over directly, after the author paid another 5 euros to renew it so it would not lapse back into the open again. In total he spent 10 euros in domain fees, received no bug bounty, and was not visited by anyone unhappy about the whole affair.

Key facts

  • All three zones for the phone codes +290 (Saint Helena), +246 (British Indian Ocean Territory / Diego Garcia) and +247 (Ascension Island) were delegated to the same two nameservers, and one of those, ns.enum.org.uk, had simply expired; the author bought it for 5 euros and controlled the DNS for all three zones.
  • Six months of logging captured about 209,000 real ENUM queries in total, 100,170 for the Diego Garcia zone, 99,902 for Ascension Island's and 9,133 for Saint Helena's, with the author estimating true traffic across both nameservers near 400,000; the logs exposed real phone numbers, timestamps and source IPs, most from American resolvers.
  • Controlling the zones meant the author could have routed any of those calls through his own SIP server and silently listened in; his server instead answered every query with NXDOMAIN, so no call content was actually intercepted, and the logs were later deleted.
  • RIPE, which manages e164.arpa, declined to fix the abandoned delegation because it is governed by an ITU-T committee at the UN level; the UK's National Cyber Security Centre acted only after being told military bases were involved.
  • After Iran fired ballistic missiles at Diego Garcia on March 20, 2026, the NCSC arranged to take the domain over, once the author renewed it for another 5 euros; the whole episode cost him 10 euros total and no bug bounty.

Why it matters

ENUM was built in the early 2000s so carriers could look up a phone number in DNS and route the call over cheap SIP instead of the traditional phone network. It never caught on and has been essentially dead for years, but the underlying DNS delegations for real country and territory codes still exist and can still be hijacked if whoever set them up forgets to renew a domain. That is exactly what happened here: an infrastructure piece nobody thought about any more, protecting phone-call routing metadata for two military installations, sat pointed at an expired domain for over a decade until it was bought for the price of a coffee.

Who it affects

Any carrier performing an ENUM lookup for a number under +290, +246 or +247 was, in principle, at the mercy of whoever controlled the hijacked nameserver. In practice the traffic was almost entirely calls involving the Diego Garcia and Ascension Island military bases, with source IPs mostly from the United States, which points to personnel and their families rather than random test traffic. On the institutional side, it implicates RIPE and the ITU-T committee structure that governs e164.arpa delegations, the UK's NCSC, which eventually took ownership, and whoever at the long-defunct Internet Computer Bureau originally set the nameservers up and then let the delegation lapse.

How to use it

There is no product here, but the mechanism is a useful checklist for anyone running DNS-backed telecom infrastructure: a delegation is only as safe as the domain its nameserver lives under, and an expired registrar record for a nameserver domain is functionally the same as losing the keys to every zone that points at it. The fix that eventually worked was not a technical patch but an ownership transfer, the domain moving from a private individual to the NCSC, since the underlying ITU-governed delegation could not simply be reassigned to a new nameserver on short notice.

How solid is it

The account comes from the person who did the hijacking, in a first-person blog post, and the traffic figures, the RIPE and NCSC interactions, and the eventual domain handover are all his own reporting rather than independently verified numbers. The involvement of Q Misell of the Max Planck Institute for Informatics as a second party who escalated to RIPE adds some corroboration to the RIPE side of the story. The piece does not name the author, and no outside confirmation of the exact query counts or of RIPE's and the NCSC's internal reasoning is available beyond what the author says he was told.

Risks and caveats

No call content was actually intercepted: the author's server answered every logged query with NXDOMAIN, sending calls over the normal phone network, and he deleted the log files once he understood what he was looking at. That does not mean the exposure was harmless; the same abandoned delegation had apparently sat unclaimed for years before he found it, so a less scrupulous party could have exploited it earlier without ever coming forward. The slow, UN-committee-bound process for fixing e164.arpa delegations also means similar abandoned zones elsewhere may still be sitting unclaimed, since neither RIPE nor a national government could resolve this one quickly on the merits alone.

“I would assume that in hundreds of thousands of calls between soldiers and their families, sensitive information would always slip here and there eventually.”

— the author of the write-up