One expired 5-euro nameserver made a researcher the phone-routing authority for three territories, and the logs filled with military calls

Five euros bought three territories' call-routing authority, and the logs filled with military-base numbers

A security researcher paid 5 euros for an expired nameserver domain and with it became the DNS authority for call-routing lookups across three territories: Saint Helena, Ascension Island, and Diego Garcia, an atoll used as a joint UK-U.S. military base since the 1970s 12. Six months of logs on those zones recorded hundreds of thousands of real call-routing queries, mostly from resolver IP addresses that were American, with dialed numbers that included military bases 1. This buyer answered every query with a nonexistent-domain response; a hostile buyer could have answered differently 1.

The scheme underneath is ENUM: an early-2000s design in which a phone number is reversed digit by digit.e164.arpa is appended, and the resulting DNS record tells a carrier where to route the call as internet voice instead of over the paid phone network 1. It saw barely any use even in its early days, and the researcher calls it basically completely dead today 1. Dead, though, is not the same as decommissioned, and these logs are what kept arriving after the authority over them became retail property.

Two nameservers, zero working redundancy

DNS delegations list more than one nameserver on purpose: when one is unreachable, queries fall to the next. The three zones here, 0.9.2.e164.arpa, 6.4.2.e164.arpa and 7.4.2.e164.arpa, the phone codes +290, +246 and +247, were delegated to exactly two: ns6.icb.co.uk and ns.enum.org.uk 1. The first no longer resolved to anything, so every query fell back to the second, and the second had expired: it sold for 5 euros 1.

On paper that is a redundant pair. In practice it was one dead host and one retail listing, which is worse than no redundancy at all: a lone nameserver at least has an owner, while the last functioning authority for three territories' call-routing DNS was purchasable by anyone with a registrar account 1.

The takeover-to-logs timeline, in order

The researcher's post tells the story personably and out of order. Reassembled chronologically, each step shows the safety net doing less than the step before it:

• Over a decade ago, in the researcher's best guess: someone at the Internet Computer Bureau, which seemingly managed the zones in the past, delegates three country-code zones to two nameservers 1.
• At an unstated later date: ns6.icb.co.uk stops resolving, silently shifting every query onto ns.enum.org.uk 1.
• Then: ns.enum.org.uk expires, and in the researcher's account nobody who depended on it was left to renew it 1.
• Takeover day: the researcher buys the domain for 5 euros and reports the takeover immediately through multiple channels into the British government, hearing nothing back 1.
• Later: Q Misell, a researcher of the Max-Planck-Institute for Informatics, reports it to RIPE, which manages e164.arpa; RIPE declines, because e164.arpa delegations are governed by an ITU-T committee at the UN level 1.
• Next: a one-day logging test on the Saint Helena zone records zero queries, so the researcher keeps the zones and hosts a personal site, a Fediverse instance and a Matrix homeserver on them 1.
• Six months in: logs across all three zones show hundreds of thousands of queries, almost none for Saint Helena and nearly all for Diego Garcia and Ascension, from mostly American resolver IPs 1.

What each query handed over

An ENUM query is the dialed number written in reverse, so the logs amounted to full phone numbers, timestamps, and the addresses of the DNS resolvers asking: a call-metadata trove accumulated by accident 1. The researcher's server replied NXDOMAIN to every one of them 1.

No exploit chain, no zero-day budget, no insider access: the entire attack surface was a forgotten renewal.

Everyone who could reassign the zones declined

The anatomy of the failure is jurisdictional, not technical. RIPE manages e164.arpa but declined to touch the delegations, holding that a UN-level ITU-T committee governs them 1. The British government channels the researcher used sent nothing back 1. And the delegation itself kept pointing at a name any registrar customer could buy. The party that could fix the routing did not own the decision, and the channels that were contacted never replied.

The counterfactual the refusals left standing

Everything about interception here stays conditional, exactly as the researcher framed it. Control of the nameserver would have allowed this: answer a lookup by pointing at your own SIP server, accept the incoming call, then dial the real destination with the caller's number spoofed, so both parties speak normally while a third listens in silence 1. A hostile holder of the same 5-euro domain could have done that to every query the logs recorded; the researcher did not 1. Whether anything sensitive was ever said on those calls remains the researcher's own marked guess, and nothing in the logs or the post shows a listener 1.

The disclosure drew a front-page Hacker News thread 3. The sharpest pushback targeted the inference chain, not the mechanics: one reader called the step from mostly-American resolver IPs to military-base calls "quite a jump to conclusion" 3. Another, describing commercial number-porting services, argued ENUM never fully died and instead went private, queried through VPN-connected private nameservers 3.

The takeaway for anyone who builds or runs systems: infrastructure is not retired because the whiteboard says so. These lookups kept arriving at a host that was for sale, months after the protocol's obituary, and the only thing standing between them and a silent listener was which stranger happened to buy the domain first. Renewal hygiene and ownership audits for delegated infrastructure zones are security policy, not registrar housekeeping. This one was priced at 5 euros, and it carried military call metadata.