A researcher who was poking at an expired nameserver ended up hijacking the DNS infrastructure that routes phone calls to entire countries — and accidentally logged hundreds of thousands of calls to US military bases.
lina.sh documents how an expired nameserver delegation let her take control of e164.arpa zones — the DNS infrastructure that maps phone numbers to VoIP servers via ENUM (E.164 Number Mapping). Take a phone number, reverse the digits, and you get a DNS query like 6.5.4.3.2.1.0.3.9.4.e164.arpa that tells carriers how to route the call. When the nameserver for certain country zones expired, she registered the domain and became the routing authority.
The result: her server started receiving ENUM queries — legitimate carrier traffic asking how to route calls. For weeks. Including calls to military bases.
The infrastructure failure
ENUM was an early-2000s idea that never fully took off in the US but got real adoption in Europe and Asia. The architecture is fundamentally a DNS delegation chain: each country's numbering authority controls its e164.arpa subdomain. When DENIC (Germany's domain registry) or similar orgs set up nameservers that later expired, those zones became hijackable.
The researcher didn't even need to do anything malicious. The hijack was passive — she just set up a server, the traffic arrived. The fact that she logged it was almost accidental: "I probably should have checked my logs sooner." What's in those logs includes phone routing queries for military installations that had their phone numbers mapped through the affected zones.
Why this matters
This isn't a theoretical vulnerability. The phone network's DNS layer is trust-based — whoever controls the nameserver controls routing. An active attacker could redirect calls, intercept VoIP traffic, or map internal numbering schemes. The only reason this isn't a catastrophe is that ENUM adoption is spotty and most carriers have internal fallbacks. But for the routes that do depend on it, there's no DNSSEC protection in practice.
The expired-nameserver pattern is as old as DNS itself, but the stakes are different when the domain controls phone infrastructure instead of a blog. The ENUM system was designed for a world where phone companies ran their own DNS reliably. That world is gone.