A forgotten DNS delegation for telephone infrastructure let an independent researcher see when numbers associated with military bases were being called and, in theory, return instructions that could redirect those calls. The immediate failure was an expired domain that cost €5 to register. The larger problem for network operators is harder to price: infrastructure can remain live long after the people responsible for it believe the system is dead.
The researcher, who publishes under the name Lina, says she gained control of the only working authoritative nameserver domain for three ENUM zones covering Saint Helena, Diego Garcia in the British Indian Ocean Territory, and Ascension Island. Six months after an initial traffic check found nothing, her logs contained 209,205 queries. Because each query encoded a telephone number in its DNS name, the data exposed full numbers, timestamps, and the source addresses of the resolvers. A secondary server was not logging, so she estimates the actual query volume was about 400,000.
Those figures and the disclosure timeline come from Lina’s detailed account, not from an independent audit or a public incident report. She says her server returned NXDOMAIN, so calls continued over the ordinary telephone network; she did not redirect or listen to them. She also says she deleted the logs, stopped serving the zones, and eventually transferred the expired nameserver domain to the UK’s National Cyber Security Centre. The NCSC has not published a confirmation linked from the disclosure.
That distinction matters. The demonstrated privacy exposure was call metadata reaching an unintended DNS operator. Interception was a capability implied by control of routing answers, not an act the researcher says she performed. Even with that limit, the case is a sharp example of why abandoned dependencies deserve the same attention as newly discovered software flaws.
ENUM put telephone routing inside DNS
ENUM is an early attempt to bridge telephone numbers and internet services. It takes a number in the international E.164 format, removes formatting, reverses the digits, separates them with dots, and places the result below e164.arpa. A client can then request NAPTR records describing services or destinations associated with that number.
For example, the current IETF ENUM specification, RFC 6116, transforms a telephone number into a fully qualified DNS name and queries it for NAPTR records. A returned record might ultimately identify a SIP URI used during call setup. Control is distributed through ordinary DNS delegation: the parent points each country-code zone toward the nameservers responsible for it.
The hierarchy is easy to overlook because its labels are reversed. The country code +246 becomes 6.4.2.e164.arpa; +247 becomes 7.4.2.e164.arpa; and +290 becomes 0.9.2.e164.arpa. According to the researcher, all three were delegated to ns6.icb.co.uk and ns.enum.org.uk. The first hostname no longer resolved, while the registration for enum.org.uk had expired. Buying that domain therefore placed its new owner on the resolution path for all three zones.
This was not a takeover of a telecom carrier or a breach of a military network. It was a dangling dependency at a layer that some phone systems still queried. That makes the episode more useful than a dramatic intrusion story: no exotic exploit was needed, and a conventional asset inventory could have caught it.
The logs revealed more than a dead protocol
Lina initially logged queries only for the Saint Helena zone and saw none during a day. That result appeared to support the common view that public ENUM had faded into irrelevance. Months later, however, logs across all three zones told a different story.
Her published breakdown lists 100,170 queries for Diego Garcia, 99,902 for Ascension Island, and 9,133 for Saint Helena. Most source addresses were American, she writes, and nearly all traffic targeted the two zones associated with military facilities. A DNS query did not reveal the content of a conversation, whether anyone answered, or necessarily who placed the call. It could still expose patterns: which number was queried, when it happened, and which resolver asked. At scale, such metadata can reveal activity without yielding a single recording.
The stranger finding is that the clients kept asking an obsolete-looking public system at all. Possible explanations include old carrier configurations, automated fallback logic, test traffic, or equipment that was never reconfigured. The disclosure does not identify the clients, and source resolver addresses alone would not settle that question. It does show that lack of traffic during a short observation window is weak evidence that an infrastructure path is unused.
The community response helped push the account into view, reaching 133 points and 20 comments on Hacker News when the brief was collected. That is an interest signal, not corroboration. The technical claims stand or fall on the researcher’s evidence, the protocol design, and any confirmation operators choose to publish.
Control of DNS could have changed the outcome
Returning NXDOMAIN made the researcher’s server behave like a dead end. A malicious operator could instead have published NAPTR records pointing toward infrastructure it controlled. Lina argues that a carrier honoring those answers could have been led to a SIP endpoint operated by an attacker, creating an opportunity to relay a call onward while sitting in the middle. Whether that would succeed for any particular call depends on the querying system, its validation, and the rest of the voice network.
The standards documents do not treat this class of risk as surprising. RFC 6116 says ordinary DNS is insecure and recommends authenticity checks such as DNSSEC. It also warns that DNSSEC is not complete endpoint authentication: a signed lookup can prove an answer belongs to the signed zone while still directing a client to a service that must authenticate itself.
In this incident, DNSSEC would only have helped if the delegation and child zone were securely configured and maintained. Cryptographic validation cannot rescue an organization that intentionally delegates authority to a nameserver domain it later allows someone else to register. The signed answer would either fail validation or faithfully express control that the organization had accidentally surrendered.
That is why the practical lesson extends beyond ENUM. Cloud storage aliases, package namespaces, webhook destinations, abandoned subdomains, email routing, and SaaS custom domains can all retain references to assets whose ownership has changed. The bug is not simply “an expired domain.” It is a lifecycle mismatch between a durable reference and an asset treated as disposable.
Responsibility was split across institutions
ENUM’s governance helps explain why cleanup was not a one-party operation. The RIPE NCC’s ENUM documentation says it provides DNS operations for the e164.arpa zone. Requests for country-code delegations are sent to RIPE NCC, passed to the International Telecommunication Union’s standardization bureau for evaluation, and technically assessed by RIPE only after ITU-T approval.
That process is designed to prevent an internet registry from independently deciding who controls a country’s telephone-number namespace. It also creates a difficult repair path when an old delegation becomes unsafe. Lina says a security researcher reported the issue to RIPE on her behalf, but RIPE would not override the committee-governed delegation. She says her early reports to UK authorities produced no visible action, while a later report emphasizing traffic tied to military bases prompted engagement.
The eventual transfer of enum.org.uk to the NCSC, as described by Lina, addressed ownership of the dangling domain. It did not modernize the underlying delegation. Public recursive DNS checks now fail for all three zones, consistent with infrastructure that is not serving valid answers, though that observation does not independently establish who controls the registration or every step in the disclosure timeline.
What operators should audit now
The obvious check is to enumerate authoritative nameservers and confirm that every hostname and parent domain is under current ownership. The less obvious work is to trace dependencies through organizational boundaries. A telecom team may own a number range while a registry manages the parent zone, a contractor owns a nameserver hostname, and an unrelated registrar controls renewals. Each party can believe another is watching the expiry date.
Operators should also inspect query telemetry over a meaningful period before declaring a legacy service unused, then retire it deliberately. That means identifying clients, removing or replacing the delegation, monitoring failures, and keeping a rollback plan. Simply turning off a server can leave the authority pointer in place for the next registrant.
The next evidence to watch for is a public response from the NCSC, RIPE NCC, ITU-T, or the affected telecom operators explaining which systems generated the queries and whether other ENUM delegations have been audited. Until then, the safe conclusion is narrower but still consequential: an expired €5 domain received a large stream of telephone-number metadata because a critical DNS reference survived its operator. The protocol may be old; the dependency was not dead.