A Researcher Registered One Dead Domain and Started Logging Calls to US Military Bases

The internet has attics. Standards written twenty years ago, deployed for a few years, then quietly abandoned by everyone except the code that still calls them. A security researcher went up into one of those attics and registered a domain. Within a short window, his server had logged hundreds of thousands of DNS queries corresponding to calls placed from US military facilities. No exploit. No intrusion. He picked up a name tag somebody dropped.

The 1990s Idea: Put Phone Numbers in DNS

Start with what ENUM actually is. In the late 1990s, telecom had a problem: the phone network and the internet lived in separate universes. Phone numbers only meant something inside the PSTN. The internet ran on domain names. How do you bridge them?

ENUM was the answer, and the idea is almost elegant. Take a number like +1-202-555-0100. Reverse the digits, put a dot between each one, and append e164.arpa. You get 0.0.1.0.5.5.5.2.0.2.1.e164.arpa. Query that name in DNS and you get back a record saying, in effect, to reach this number over SIP, send it here. The phone number is the domain.

The .arpa TLD is itself a fossil from the early internet, now mostly reserved for infrastructure plumbing like reverse DNS lookups. ENUM moved in. It was a real standard with real institutional weight — the ITU was involved, delegation structures were designed per country code, the whole apparatus. It looked serious.

It just never got used.

The Standard Died. The Code Didn’t.

ENUM failed for political reasons, not technical ones. Publishing the world’s phone numbers into public DNS meant carriers giving away their most valuable asset for free. Nobody could agree on who administered which number ranges, or how privacy would work. The public ENUM tree stayed effectively empty. Carriers built private ENUM instead and used it only among themselves.

That part is an ordinary story about a standard that didn’t take. Here’s the part that matters.

VoIP software — especially open-source SIP stacks and PBX platforms — shipped ENUM lookups as a default option. Config files written in the early-to-mid 2000s enabled it out of the box. The reasoning was sound at the time: if a dialed number happens to be registered in ENUM, route it over the internet directly and skip the toll charges. A perfectly reasonable optimization. In 2004.

Those config lines are still there. Twenty years of copy-paste — a config from a vendor manual becomes a config in production, gets cloned to the next box, gets migrated to a new install, gets inherited by an admin who never read that line and has no idea what it does. Every outbound call, the system quietly fires a query at e164.arpa. Nothing answers. The call falls through to the normal PSTN route and connects fine. Nobody notices anything wrong, because nothing is wrong from the caller’s side.

Only the queries kept going out.

What Happens When You Adopt an Orphaned Subdomain

What the researcher did next was technically unremarkable. He looked under e164.arpa for country-code zones that were delegated but not actually operated — or whose nameserver domains had lapsed and been left to expire. Then he took the slot.

When an abandoned nameserver domain expires, anyone can register it. But the parent zone still carries the delegation record saying, for this number range, go ask that nameserver. So every query on earth for that range now flows to the new owner’s server. The technique is called lame delegation hijacking. There is no novel exploit involved. It’s just DNS hygiene nobody performed, for a zone nobody was watching.

Then the logs started filling up.

A single DNS query carries more than people assume. The queried name is the number being dialed. The source IP tells you where the calling phone system sits. The timestamp tells you when the call was placed. You can’t hear the conversation. But you get who, from where, when, and to what number — for every call.

This is exactly why intelligence services have always preferred metadata to content. Content requires interpretation. Metadata is already a social graph.

Why the Military Showed Up in the Logs

The story changes character at the point where hundreds of thousands of those records trace back to military and defense-adjacent facilities.

That’s not coincidence — it’s structural. Large organizations run their own IP telephony. And large organizations replace systems slowly. Organizations that require accreditation and formal security review before any change replace them slower still. No admin is going to touch a PBX config that was deployed in 2008, passed certification, and has worked ever since. “If it isn’t broken, don’t touch it” is normally good operational discipline. Here it’s the failure mode.

The traffic also sails straight past perimeter defenses. DNS has to egress; that’s the whole point of DNS. This is a plain UDP/53 lookup to a name under an IANA-administered TLD. No threat feed on earth lists .arpa as suspicious. The data leaks out over infrastructure that is functioning exactly as designed.

And a list of numbers dialed out of a base tells you plenty on its own. Which units talk to which contractors, how often, and how call volume shifts in the weeks before something happens. To anyone doing counterintelligence, that is not a rounding error.

Zombie Protocols Are the Real Attack Surface

Reading this as a story about ENUM misses the point.

The security threats we’re trained to imagine are active. Find a vulnerability, write an exploit, get in. This is the inverse. The attacker penetrated nothing. The victim systems had been transmitting for twenty years. All he did was open the mailbox.

ENUM is not the only zombie protocol out there. Default NTP server addresses baked into firmware. Update-check URLs hardcoded into software that shipped a decade ago. Telemetry endpoints belonging to companies that no longer exist. API domains that deprecated SDKs still dial. Researchers have run the expired-domain-and-listen experiment before, repeatedly, on different corners of the internet, and the result is consistently the same: far more systems than anyone expects are still talking to ghosts.

The internet never deleted anything. It just forgot.

One caveat worth stating plainly: this research is recent enough that independent analysis hasn’t caught up. Specific counts and the true scope of exposure may look different after follow-up work. But the underlying weakness isn’t a new discovery — people have been pointing at lame delegations and abandoned zones for years. That’s the genuinely unsettling part.

What to Actually Do About It

The immediate fix is almost boring. If you run SIP servers or an IP-PBX, go check whether ENUM lookups are enabled. On Asterisk, FreeSWITCH, and Kamailio, look for ENUM references in your dialplan or routing logic. Unless you are deliberately using private ENUM with a carrier, turning off public e164.arpa resolution costs you nothing. Those lookups were never getting answers anyway.

The harder question comes next. Do you have a list of every destination your systems contact that you don’t control? Has anyone logged your outbound DNS queries and actually read them? For most organizations the honest answer is no.

Dead standards only die on paper. In code, they keep executing. Right now some server somewhere is greeting a domain whose owner changed hands, because of one line somebody pasted in from a manual twenty years ago. Has anyone checked who’s answering?