By ByteBot
A security researcher bought two expired domain names for roughly €5 each and inadvertently gained control over ENUM DNS zones routing phone calls across three British military territories. On August 21, 2026, she published findings showing her logging nameserver had silently captured approximately 400,000 DNS queries over six months — full phone numbers, timestamps, and resolver IPs — predominantly from U.S. military installations on Diego Garcia and Ascension Island. The attack required no exploits, no malware, and no sophisticated tooling. It required a domain registration form and a credit card.
What ENUM Is and Why Expired Nameservers Are a Zone-Level Risk
ENUM is an early-2000s protocol (RFC 2916) that maps telephone numbers to DNS records under the e164.arpa zone tree. The idea was straightforward: reverse a phone number’s digits, insert dots, append .e164.arpa, and VoIP carriers could look up NAPTR records to route calls over cheap internet SIP instead of the public switched telephone network. ENUM never achieved mainstream adoption and is widely considered dead technology. The infrastructure, however, remained.
The three zones the researcher controlled — 6.4.2.e164.arpa (Diego Garcia, +246), 7.4.2.e164.arpa (Ascension Island, +247), and 0.9.2.e164.arpa (Saint Helena, +290) — had delegated DNS authority to a nameserver called ns.enum.org.uk. That domain had expired. When the researcher purchased it for approximately €5, she inherited authority over DNS resolution for all three zones. As she put it: “If I control the nameserver a domain points to, I control every DNS response for that domain.” The other nameserver in the delegation, ns6.icb.co.uk, was no longer resolving at all.
Six Months of Military Phone Metadata
Her logging nameserver captured 100,170 queries to the Diego Garcia zone, 99,902 to the Ascension Island zone, and 9,133 to the Saint Helena zone — roughly 209,000 captured queries representing an estimated 400,000+ total requests. The source IPs were “mostly American.” Diego Garcia hosts the U.S. Naval Support Facility and B-2 bomber operations. Ascension Island hosts RAF and U.S. Air Force facilities. The researcher did not review the logs for six months. The March 20, 2026 Iranian ballistic missile strike on Diego Garcia occurred during the exposure window.
What a malicious actor could have done: man-in-the-middle call routing by returning fraudulent NAPTR records, spoof outgoing calls using military phone numbers, or log months of call metadata for intelligence value. The researcher did not intercept call audio — ENUM routes to SIP; she did not control the SIP layer — but the metadata exposure was significant. Call patterns, phone numbers, and network topology are intelligence assets. She immediately shut down her server and deleted all logs upon realizing what she was looking at.
Related: AI Code Fails Security Checks 44% of the Time — Fix It
Half of e164.arpa Delegations Have DNS Problems
This is not an isolated misconfiguration. A RIPE Labs operational review of public ENUM found that half of all current e164.arpa delegations exhibit DNS problems — broken delegations, missing records, or zones pointing to expired or non-resolving nameservers. Dead protocols do not become safe when they stop being used. They become invisible. Invisible infrastructure is the highest-risk, lowest-visibility attack surface in any organization’s stack.
The remediation process compounded the exposure. The researcher reported the issue to UK government channels — no response. RIPE declined action, citing ITU-T committee jurisdiction. Only after she explicitly mentioned military bases did the UK’s National Cyber Security Centre escalate, assume control of the domain, and begin remediation. At publication time, the delegation was still technically unresolved in some configurations. Bureaucratic jurisdiction gaps mean that even reported vulnerabilities in legacy infrastructure can take months to close.
What Developers Need to Check for DNS Zone Takeover
NS-level zone takeover is more severe than the better-known CNAME subdomain takeover. A dangling CNAME lets an attacker control one hostname. A dangling NS record lets an attacker control every hostname and every DNS response across the entire delegated zone. The OWASP Subdomain Takeover Prevention Cheat Sheet classifies NS-level takeover as the highest-severity form of DNS delegation vulnerability, yet most security scanning tools focus on CNAME records and miss NS delegation entirely.
The common sources of dangling NS records: changing DNS providers without removing old NS entries, decommissioning cloud resources (AWS, Azure, GCP) without cleaning up delegation, and abandoning Heroku dynos, GitHub Pages configs, or S3 buckets without auditing associated DNS. ENUM is an extreme case, but the mechanism is identical to scenarios your infrastructure almost certainly encounters. Run a DNS audit that explicitly checks NS record targets for expiry dates. Set renewal reminders. If you no longer control a nameserver domain, remove the delegation immediately.
Key Takeaways
- An expired nameserver domain purchased for €5 granted full DNS control over military phone routing zones — no exploits required
- NS-level zone takeover is more severe than CNAME subdomain takeover: it exposes an entire zone, not just a single hostname
- RIPE’s own review found 50% of e164.arpa delegations have DNS problems — dead infrastructure is not safe infrastructure
- Governance gaps between RIPE, ITU-T, and national CERTs mean reported vulnerabilities in legacy protocol zones can remain unpatched for months
- Audit your NS records now: any zone delegating to a nameserver domain you no longer control is a live attack surface
