One €5 Domain, 400,000 Military Phone Calls

For €5, one researcher bought the DNS for three territories' phone networks. Not their websites: the phone number zones. The whole story is told in her own words — one of those "wait, really?" posts, and it holds up.

What e164.arpa even is (for non-DNS people)//

ENUM (RFC 3761) was an early-2000s idea: take a phone number, reverse the digits, and look it up as a DNS name — +49 30 123456 becomes 6.5.4.3.2.1.0.3.9.4.e164.arpa. A carrier querying the zone gets back a NAPTR record saying "this number can be reached over SIP/VoIP at this address", skipping the expensive phone network and routing the call over the cheap internet instead.

It never really took off. It saw barely any use even in its early days, and today it's "basically completely dead" in the researcher's words. But "dead" isn't "unqueried" — and that gap is where this story lives. (Fun footnote: she personally owns a German e164.arpa domain pointing at her own site, and was the first person since 2019 to register one — technically not supposed to, because the RFC says don't use .arpa names as real domains. It's still just DNS at the end of the day.)

How a €5 domain becomes three territories' phone network//

She was scanning e164.arpa to see how neglected the delegations really were, and found three country-code zones — 0.9.2.e164.arpa, 6.4.2.e164.arpa, and 7.4.2.e164.arpa — all delegated to the same two nameservers:

• ns6.icb.co.uk — the parent domain still exists, but this subdomain no longer resolves to anything.
• ns.enum.org.uk — an expired domain.

When a zone's first nameserver is dead, resolvers fall back to the second one listed. So she bought the expired ns.enum.org.uk for €5 and, in her words, "just like that I controlled the DNS" for all three zones. Un-reversed, those are +290 (Saint Helena), +246 (British Indian Ocean Territory — Diego Garcia), and +247 (Ascension Island) — three British territories that happen to host military bases (and that also own the .sh, .io, and .ac ccTLDs, in case you'd ever wondered).

The mechanics of the exposure: when a carrier does an ENUM lookup, it's asking "where do I route this call?" She could have answered with her own SIP server, accepted the incoming call, and placed an outgoing call to the real destination with a spoofed number. The person being called sees the original number ringing, picks up, and talks to the caller as if everything is normal — while a third party sits silently in the middle of the entire conversation.

Six months of quiet logging//

Her first report went to the British government through multiple channels. She got nothing back. RIPE — who manage e164.arpa — declined to act, because the delegations are governed by an ITU-T committee at the UN level, and RIPE wasn't willing to go against a UN committee. Her best guess on the cause: someone at the Internet Computer Bureau set these nameservers up over a decade ago, ENUM slowly died, and nobody remembered to renew a domain the system depended on.

Since nobody seemed to care, she kept the domain and had fun with it: a personal site on one of the zones, a Fediverse instance, a Matrix homeserver, subdomains handed out to friends. "It's a dead system. It's not like it's gonna hurt anyone." And she enabled logging.

The first day: zero queries on Saint Helena. Six months later: hundreds of thousands of ENUM queries across all three zones — almost none for Saint Helena, almost entirely for Diego Garcia and Ascension Island, with resolver source IPs "mostly American". Because the domain name is the reversed phone number, the logs were simply: full phone numbers, timestamps, and the source IPs of the resolvers making the requests.

Her own log totals: 100,170 queries to Diego Garcia, 99,902 to Ascension Island, 9,133 to Saint Helena. A friend's secondary nameserver (set up without logging) was receiving the other half of the traffic, so her working estimate is ~400,000 requests in total.

Her DNS server had been replying NXDOMAIN to everything, so the calls were still being routed over the normal phone network — nobody got hijacked, they just got observed. Once she realized that, she shut the server down and deleted the logs.

The part that made people care//

Her second report went to the UK's National Cyber Security Centre — with "military bases" in it — and this time they cared a lot. They couldn't figure out who had originally set up the abandoned delegation, and the ITU-committee problem kept blocking a proper fix. The domain sat with her for another year: wiped to NXDOMAIN, but still hers, still up for grabs if she didn't pay.

Then, on 2026-03-20, Iran fired ballistic missiles at Diego Garcia. She notes she'd have liked to see whether calls from worried family spiked that day — by then she was long done logging. The point is that a state actor with an interest in that specific base would have loved sitting on six months of call metadata without anyone noticing.

The NCSC then had her transfer the domain directly to them — right after she had to renew it for another €5, or it would have been up for grabs again. Final tally: €10 in domain fees, no bug bounty (and thankfully no kicked-in door).

The boring, transferable lesson//

The infrastructure for an early-2000s standard is still being queried by real phone carriers, and the only thing standing between that traffic and a stranger was an expired domain nobody renewed. Nobody broke in — no crypto was cracked, no firewall was bypassed. The NS delegation just pointed at a name that went up for auction.