I accidentally logged hundreds of thousands of phone calls to military bases - lina's blog
back home
back to blogs
How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.
2026-07-30
short: https://lina.sh/-e164
DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately<br>reported that and moved on.
This one is a little different though, it's about how I took over phone-network infrastructure domains (e164.arpa) of<br>entire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let's start at<br>the beginning.
What is e164.arpa anyway?
ENUM (e164.arpa) was an idea from the early 2000s1: take a phone number, reverse the digits, put dots between<br>them, and add .e164.arpa at the end, so +49 30 123456 becomes something like 6.5.4.3.2.1.0.3.9.4.e164.arpa. You<br>can see that every German number will end up under .9.4.e164.arpa, which is the zone for all +49 numbers, and that<br>zone is controlled by DENIC (the same organization that runs .de). This means the DENIC decides which carrier or person<br>gets which number ranges under that zone, just like they hand out .de domains (which makes it decentralized, making every<br>country decide on delegation themselves).
The idea was that carriers could then look these domains up and get back a record saying "hey, this number can be<br>reached over SIP/VoIP under this address", skipping the expensive phone network and re-routing calls over the cheap<br>internet instead.
It never really took off though, and even back in its early days it saw barely any use. Over the years it just<br>deteriorated further, and today it's basically completely dead. I do actually own<br>5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa and<br>point it at this website, although technically I'm not supposed to do that (you can figure out my secondary number from<br>that!). Germany is actually one of the last countries that still technically allows registering an e164.arpa domain,<br>although I was the first person since 2019 to register one2.
The RFC says you should only set NAPTR records on these domains, which are the records that tell carriers where to route a call.<br>It states that you absolutely shouldn't be using .arpa domains as normal "domains" and host stuff like websites on them,<br>they are meant to be "infrastructure" domains (you might know in-addr.arpa for reverse DNS lookups for example).<br>But there's nobody who can actually stop you from doing it, it's still just DNS at the end of the day,<br>and nothing prevents you from slapping an A record on there and hosting a website. Some people actually really dislike that,<br>and try to get Certificate Authorities to no longer issue certificates for .arpa domains3.
Hijacking a territory's phone network
I was scanning e164.arpa to see if any of the delegated zones were hijackable, mostly out of curiosity about how<br>neglected this whole system really was.
I found three country-code zones, 0.9.2.e164.arpa, 6.4.2.e164.arpa, and 7.4.2.e164.arpa, all delegated to the same<br>two nameservers: ns6.icb.co.uk and ns.enum.org.uk.
Quick explainer for anyone who isn't a DNS person: when a domain is delegated to a nameserver, it basically means "for<br>any question about this domain, go ask this server, it has the answers", and if I control the nameserver a domain points<br>to, I control every DNS response for that domain.
icb.co.uk still exists as a domain, but the specific ns6.icb.co.uk subdomain no longer resolves to anything, meaning<br>any request falls back to the second listed nameserver instead: ns.enum.org.uk.
And that domain had expired, so I bought it for just 5€, and just like that I controlled the DNS for 0.9.2.e164.arpa,<br>6.4.2.e164.arpa, and 7.4.2.e164.arpa. Reversed, those are phone codes +290, +246, and +247: Saint Helena, the<br>British Indian Ocean Territory (Diego Garcia), and Ascension Island respectively (funnily enough, those<br>territories also have the popular ccTLDs .sh, .io, and .ac).
To be clear about what this meant: when a carrier does an ENUM lookup for one of these numbers, they're essentially<br>asking "where do I route this call?", and I could answer with whatever I wanted. I could point it at my own SIP server,<br>accept the incoming call, and then place an outgoing call to the real destination with a spoofed number.<br>The person being called would see the original number ringing, and after picking up would speak to the person on the<br>other end as if everything was normal, but I'd be sitting silently in the middle of the entire conversation.<br>I would theoretically be able to do this for every single request that I got if I could re-route a number, if<br>anyone was still actually using this system.
I reported it right away to everyone I could think of, through multiple channels into the British government, and got<br>nothing back. My best guess is that someone at the Internet Computer Bureau (who seemingly managed them in...