DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately reported that and moved on. This one is a little different though, it's about how I took over phone-network infrastructure domains (e164.arpa) of entire territories, and accidentally logged hundreds of thousands of phone calls to military bases.

ENUM (e164.arpa) was an idea from the early 2000s: take a phone number, reverse the digits, put dots between them, and add .e164.arpa at the end. The system never really took off and today it's basically completely dead.

I found three country-code zones all delegated to the same two nameservers. One subdomain no longer resolved, and the other domain had expired, so I bought it for just 5€, and just like that I controlled the DNS for Saint Helena, the British Indian Ocean Territory (Diego Garcia), and Ascension Island.

After enabling logging, I discovered hundreds of thousands of ENUM queries, mostly targeting Diego Garcia and Ascension Island military bases. The source IPs were mostly American. I shut down the DNS server and deleted all log files. When I reported it again to the UK's National Cyber Security Centre (NCSC), mentioning military bases were involved, they actually cared a lot.