I Accidentally Logged Hundreds of Thousands of Phone Calls to Military Bases

Originally posted on lina's blog Date: 2026-07-30 | Shortlink: https://lina.sh/-e164

While I have previously managed to take over .edu and .gov domains, those were straightforward cases of reporting the vulnerability and moving on. This situation was fundamentally different. I managed to seize control of the phone-network infrastructure domains (e164.arpa) for several entire territories, which inadvertently led to me logging a massive volume of calls directed at military installations.

Understanding ENUM (e164.arpa)

Developed in the early 2000s, ENUM was designed to bridge the gap between traditional telephony and the internet. The logic is simple: take a phone number, reverse the digits, separate them with dots, and append .e164.arpa.

The Transformation Process

For example, a German number like +49 30 123456 is converted as follows:

$\text{+49 30 123456} \rightarrow \text{6.5.4.3.2.1.0.3.9.4.e164.arpa}$

Because all German numbers end in .9.4.e164.arpa, that specific zone is managed by DENIC (the same entity that handles .de domains). This decentralized approach allows each country to delegate its own number ranges.

The Goal: Carriers could perform a DNS lookup to find a NAPTR record, which would provide a SIP/VoIP address. This allowed calls to be routed over the internet rather than the expensive traditional phone network.

The Reality: The system never really took off failed to gain traction and is now essentially a digital ghost town.

[!NOTE] I actually own 5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa and point it to my website. While this technically violates the intended use of the zone, it's a fun way to hide my secondary phone number!

Infrastructure vs. Standard Domains

According to the RFCs, .arpa domains are strictly for infrastructure (similar to in-addr.arpa for reverse DNS). They are not meant for hosting websites. However, since it is still just DNS, nothing physically prevents someone from adding an A record and launching a site. This has led some to lobby Certificate Authorities to stop issuing SSL certificates for .arpa domains.

---

The Hijack: Seizing Territory Infrastructure

Driven by curiosity about how neglected this system had become, I scanned e164.arpa for hijackable delegated zones. I discovered three country-code zones pointing to the same two nameservers:

1. ns6.icb.co.uk
2. ns.enum.org.uk

The Vulnerability Chain

• Step 1: Check ns6.icb.co.uk $\rightarrow$ Does not resolve.
• Step 2: Check ns.enum.org.uk $\rightarrow$ Domain has expired.
• Step 3: Purchase ns.enum.org.uk for 5€.
• Step 4: Assume control of all delegated zones.

By owning that single expired domain, I became the authority for the following territories:

The Potential for Interception

If a carrier still used ENUM for these regions, they would ask my server, "Where do I route this call?" I could have responded with my own SIP server.

The Attack Vector:

1. I accept the incoming call.
2. I forward the call to the actual destination using a spoofed number.
3. The recipient sees the original caller's ID.
4. I sit silently in the middle of the conversation, listening to everything.

---

The Aftermath and Bureaucratic Silence

I immediately attempted to report this to various channels within the British government, but I received zero responses. It appears the Internet Computer Bureau set these up years ago and simply forgot to renew the domain as the technology became obsolete.

Eventually, Q Misell (Max-Planck-Institute for Informatics) helped me report the issue to RIPE. However, RIPE refused to intervene because e164.arpa delegations are managed by an ITU-T committee at the UN level. RIPE was unwilling to navigate the "bureaucratic nightmare" of contradicting a UN committee.

The Discovery

Curious if anyone was actually using these zones, I set up logging on the Saint Helena zone (0.9.2.e164.arpa). After waiting 24 hours, I realized that despite the system being "dead," it was still being queried—frequently.

I had successfully captured data on hundreds of thousands of calls, many of which were directed toward military bases.