{ "archive_path": "archive/1787686919.428035", "base_url": "lina.sh/blog/hijacking-e164-arpa", "basename": "hijacking-e164-arpa", "bookmarked_date": "2026-08-25 19:41", "canonical": { "archive_org_path": "https://web.archive.org/web/lina.sh/blog/hijacking-e164-arpa", "dom_path": "output.html", "favicon_path": "favicon.ico", "git_path": "git/", "google_favicon_path": "https://www.google.com/s2/favicons?domain=lina.sh", "headers_path": "headers.json", "htmltotext_path": "htmltotext.txt", "index_path": "index.html", "media_path": "media/", "mercury_path": "mercury/content.html", "pdf_path": "output.pdf", "readability_path": "readability/content.html", "screenshot_path": "screenshot.png", "singlefile_path": "singlefile.html", "warc_path": "warc/", "wget_path": "lina.sh/blog/hijacking-e164-arpa.html" }, "domain": "lina.sh", "extension": "", "hash": "1XGQ9M1CAGXK9PRA960Z", "history": { "archive_org": [], "dom": [], "favicon": [ { "cmd": [ "curl", "--silent", "--location", "--compressed", "--max-time", "60", "--output", "favicon.ico", "--user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)", "https://www.google.com/s2/favicons?domain=lina.sh" ], "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)", "end_ts": "2026-08-25T19:44:20.505145+00:00", "index_texts": null, "output": "favicon.ico", "pwd": "/data/archive/1787686919.428035", "schema": "ArchiveResult", "start_ts": "2026-08-25T19:44:19.927861+00:00", "status": "succeeded" } ], "git": [], "headers": [ { "cmd": [ "curl", "--silent", "--location", "--compressed", "--head", "--max-time", "60", "--user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)", "https://lina.sh/blog/hijacking-e164-arpa" ], "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)", "end_ts": "2026-08-25T19:44:21.113912+00:00", "index_texts": null, "output": "headers.json", "pwd": "/data/archive/1787686919.428035", "schema": "ArchiveResult", "start_ts": "2026-08-25T19:44:20.513790+00:00", "status": "succeeded" } ], "htmltotext": [], "media": [], "mercury": [ { "cmd": [ "/app/node_modules/@postlight/parser/cli.js", "https://lina.sh/blog/hijacking-e164-arpa" ], "cmd_version": "1.0.0", "end_ts": "2026-08-25T19:44:33.732210+00:00", "index_texts": null, "output": "mercury", "pwd": "/data/archive/1787686919.428035", "schema": "ArchiveResult", "start_ts": "2026-08-25T19:44:29.866384+00:00", "status": "succeeded" } ], "pdf": [], "readability": [ { "cmd": [ "/app/node_modules/readability-extractor/readability-extractor", "/tmp/tmpliwryn1g", "https://lina.sh/blog/hijacking-e164-arpa" ], "cmd_version": "0.0.11", "end_ts": "2026-08-25T19:44:29.856155+00:00", "index_texts": [ "DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately\nreported that and moved on.\nThis one is a little different though, it's about how I took over phone-network infrastructure domains (e164.arpa) of\nentire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let's start at\nthe beginning.\nWhat is e164.arpa anyway?\nENUM (e164.arpa) was an idea from the early 2000s1: take a phone number, reverse the digits, put dots between\nthem, and add .e164.arpa at the end, so +49 30 123456 becomes something like 6.5.4.3.2.1.0.3.9.4.e164.arpa. You\ncan see that every German number will end up under .9.4.e164.arpa, which is the zone for all +49 numbers, and that\nzone is controlled by DENIC (the same organization that runs .de). This means the DENIC decides which carrier or person\ngets which number ranges under that zone, just like they hand out .de domains (which makes it decentralized, making every\ncountry decide on delegation themselves).\nThe idea was that carriers could then look these domains up and get back a record saying \"hey, this number can be\nreached over SIP/VoIP under this address\", skipping the expensive phone network and re-routing calls over the cheap \ninternet instead.\nIt never really took off though, and even back in its early days it saw barely any use. Over the years it just\ndeteriorated further, and today it's basically completely dead. I do actually own\n5.8.7.1.7.1.3.2.6.1.9.4.e164.arpa and\npoint it at this website, although technically I'm not supposed to do that (you can figure out my secondary number from\nthat!). Germany is actually one of the last countries that still technically allows registering an e164.arpa domain,\nalthough I was the first person since 2019 to register one2.\nThe RFC says you should only set NAPTR records on these domains, which are the records that tell carriers where to route a call.\nIt states that you absolutely shouldn't be using .arpa domains as normal \"domains\" and host stuff like websites on them,\nthey are meant to be \"infrastructure\" domains (you might know in-addr.arpa for reverse DNS lookups for example).\nBut there's nobody who can actually stop you from doing it, it's still just DNS at the end of the day, \nand nothing prevents you from slapping an A record on there and hosting a website. Some people actually really dislike that,\nand try to get Certificate Authorities to no longer issue certificates for .arpa domains3.\nHijacking a territory's phone network\nI was scanning e164.arpa to see if any of the delegated zones were hijackable, mostly out of curiosity about how\nneglected this whole system really was.\nI found three country-code zones, 0.9.2.e164.arpa, 6.4.2.e164.arpa, and 7.4.2.e164.arpa, all delegated to the same\ntwo nameservers: ns6.icb.co.uk and ns.enum.org.uk.\n\nQuick explainer for anyone who isn't a DNS person: when a domain is delegated to a nameserver, it basically means \"for\nany question about this domain, go ask this server, it has the answers\", and if I control the nameserver a domain points\nto, I control every DNS response for that domain.\nicb.co.uk still exists as a domain, but the specific ns6.icb.co.uk subdomain no longer resolves to anything, meaning\nany request falls back to the second listed nameserver instead: ns.enum.org.uk.\nAnd that domain had expired, so I bought it for just 5\u20ac, and just like that I controlled the DNS for 0.9.2.e164.arpa,\n6.4.2.e164.arpa, and 7.4.2.e164.arpa. Reversed, those are phone codes +290, +246, and +247: Saint Helena, the\nBritish Indian Ocean Territory (Diego Garcia), and Ascension Island respectively (funnily enough, those\nterritories also have the popular ccTLDs .sh, .io, and .ac).\nTo be clear about what this meant: when a carrier does an ENUM lookup for one of these numbers, they're essentially\nasking \"where do I route this call?\", and I could answer with whatever I wanted. I could point it at my own SIP server,\naccept the incoming call, and then place an outgoing call to the real destination with a spoofed number.\nThe person being called would see the original number ringing, and after picking up would speak to the person on the\nother end as if everything was normal, but I'd be sitting silently in the middle of the entire conversation.\nI would theoretically be able to do this for every single request that I got if I could re-route a number, if\nanyone was still actually using this system.\nI reported it right away to everyone I could think of, through multiple channels into the British government, and got\nnothing back. My best guess is that someone at the Internet Computer Bureau (who seemingly managed them in the past)\nset these nameservers up over a decade ago. Then e164.arpa slowly died out, and whoever set it up either moved on or\njust forgot about it, leaving nobody to renew a domain nobody remembered they depended on.\nChecking if anyone actually uses this\nQ Misell (a researcher of the Max-Planck-Institute for Informatics) had heard about this and reported it to RIPE (who manages e164.arpa) on my behalf, but RIPE also declined to do anything, because\ne164.arpa delegations are governed by an ITU-T committee at the UN level. And RIPE wasn't willing to go against a \ndecision made by a UN committee, which would probably be a bureaucratic nightmare.\nQ also asked if I had any data on how much traffic these zones actually got, which I didn't know.\nAnd because I was very curious about that myself, I set up logging on 0.9.2.e164.arpa (Saint Helena) to find out, and waited a full day.\nNot a single query came in. So after trying my best to get anyone to care and getting nowhere, I just kept the domains,\nsince nobody seemed to be relying on them anyway.\nI hosted my personal site on it,\nspun up a Fediverse instance, a Matrix\nhomeserver, and handed out subdomains to friends, because why not, it's a dead system. It's not like it's gonna\nhurt anyone, and no one cares. So it's time to be whimsical and have fun with it.\n\nSix months later...\nJust out of curiosity, I checked the logs again on all three zones,\nsince I enabled logging running on the other two as well when I set everything up.\nHundreds of thousands of ENUM queries, all logged4. Since the domain name is literally just the phone number reversed,\nyou can simply flip it back around to get the real number, so I had full phone numbers, timestamps, and the source IP\naddresses of the DNS resolvers making the requests.\n\nHundreds of thousands of lines in logs looking just like this (phone numbers are randomized)\nAlmost none of it was for Saint Helena (0.9.2.e164.arpa), it was basically almost entirely 6.4.2.e164.arpa and\n7.4.2.e164.arpa: Diego Garcia and Ascension Island. The source IPs were mostly American. That would at least explain\nwhy I originally didn't see any traffic, as I was only logging Saint Helena.\nSo I had accidentally logged hundreds of thousands of phone numbers and timestamps for calls going to military bases.\nAnd as described earlier, a malicious actor could have simply MITM'd every single one of them. I mean I am no expert,\nbut I would assume that in hundreds of thousands of calls between soldiers and their families, sensitive information\nwould always slip here and there eventually. A nation state with an interest in what's happening on those bases would\nhave absolutely\nloved sitting on this for months without anyone noticing.\nIt's not hard to imagine who might want that kind of intel on Diego Garcia specifically, but I'll get to that later.\nMy DNS server replied with an NXDOMAIN for all queries, so they were just being routed over the normal phone network.\nBut after realizing this I shut the DNS server down and deleted all the log files.\nSuddenly, people care\nI reported it for a second time to the UK's National Cyber Security Centre (NCSC), and this time, mentioning that\nmilitary\nbases were involved, they actually cared a lot.\nThey couldn't figure out who had originally set up the abandoned delegation, and actually fixing it properly ran into\nthe same ITU-committee issues from earlier, so for a while nothing changed. Even a year later I still\nowned the domain and could've in theory still intercept the traffic, though I had wiped the zone completely so\nns.enum.org.uk just returned NXDOMAIN for everything at that point.\nThen on March 20th, 2026, Iran fired ballistic missiles at Diego Garcia5.\nIt maybe would've been interesting to see if there was a spike in calls from worried family members that day, but by\nthen I was long done logging anything. But this shows that a state actor could have been interested in this information.\nShortly after, the NCSC let me transfer ownership of the domain directly to them, right after I had to renew it for\nanother 5\u20ac (because otherwise, it would be up for grabs again, and anyone could do the aforementioned stuff).\nSo the NCSC now controls ns.enum.org.uk, but the nameservers for those three zones still point there.\nSo in the end, I was down 10\u20ac in domain fees, there was sadly no bug bounty (I thankfully didn't get my door kicked in\nat least).\nAnd on top of that, it's a funny story :P\nFootnotes\n\n\n\nRFC 3761 - The E.164 to URI DDDS Application (ENUM)\u00a0\u21a9\n\n\nThe DENIC publishes annual reports on their ENUM registrations, the last time anyone \nregistered one was in 2019, up until when I registered three in 2025.\u00a0\u21a9\n\n\n\u00a0\u21a9\n\n\nAt this point, a friend of mine (86dd) had set up a secondary nameserver for the zones, without any logging.\nI had logged 100,170 queries to 6.4.2.e164.arpa and 99,902 queries to 7.4.2.e164.arpa, and 9,133 queries to 0.9.2.e164.arpa. \nThis should be approximately half of the total queries that were sent to us; Meaning it were ~400.000 requests in total\u00a0\u21a9\n\n\nWikipedia: 2026 Iranian strike on Diego Garcia\u00a0\u21a9" ], "output": "readability", "pwd": "/data/archive/1787686919.428035", "schema": "ArchiveResult", "start_ts": "2026-08-25T19:44:27.960576+00:00", "status": "succeeded" } ], "screenshot": [], "singlefile": [], "title": [ { "cmd": [ "curl", "--silent", "--location", "--compressed", "--max-time", "60", "--user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)", "https://lina.sh/blog/hijacking-e164-arpa" ], "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)", "end_ts": "2026-08-25T19:44:27.953094+00:00", "index_texts": null, "output": "I accidentally logged hundreds of thousands of phone calls to military bases - lina's blog", "pwd": "/data/archive/1787686919.428035", "schema": "ArchiveResult", "start_ts": "2026-08-25T19:44:27.935923+00:00", "status": "succeeded" } ], "wget": [ { "cmd": [ "wget", "--no-verbose", "--adjust-extension", "--convert-links", "--force-directories", "--backup-converted", "--span-hosts", "--no-parent", "-e", "robots=off", "--timeout=60", "--restrict-file-names=windows", "--warc-file=/data/archive/1787686919.428035/warc/1787687061", "--page-requisites", "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) wget/GNU Wget 1.21.3", "--compression=auto", "https://lina.sh/blog/hijacking-e164-arpa" ], "cmd_version": "GNU Wget 1.21.3", "end_ts": "2026-08-25T19:44:27.925625+00:00", "index_texts": null, "output": "lina.sh/blog/hijacking-e164-arpa.html", "pwd": "/data/archive/1787686919.428035", "schema": "ArchiveResult", "start_ts": "2026-08-25T19:44:21.123042+00:00", "status": "succeeded" } ] }, "icons": null, "is_archived": true, "is_static": false, "latest": { "archive_org": null, "dom": null, "favicon": "favicon.ico", "git": null, "media": null, "pdf": null, "screenshot": null, "singlefile": null, "title": "I accidentally logged hundreds of thousands of phone calls to military bases - lina's blog", "warc": null, "wget": "lina.sh/blog/hijacking-e164-arpa.html" }, "link_dir": "/data/archive/1787686919.428035", "newest_archive_date": "2026-08-25T19:44:29.866384+00:00", "num_failures": 0, "num_outputs": 6, "oldest_archive_date": "2026-08-25T19:44:19.927861+00:00", "path": "/blog/hijacking-e164-arpa", "schema": "Link", "scheme": "https", "snapshot_id": "c40d682d-09ad-42eb-8670-19f8bb3c82ea", "sources": [ "/data/sources/1787686919-import.txt" ], "tags": null, "tags_str": "", "timestamp": "1787686919.428035", "title": "I accidentally logged hundreds of thousands of phone calls to military bases - lina's blog", "updated": "2026-08-25T19:44:19.927342+00:00", "updated_date": "2026-08-25 19:44", "url": "https://lina.sh/blog/hijacking-e164-arpa" }