security, #api, #cybersecurity, #discuss On July 30, 2026, my batch job finished 300,000 domain-to-company lookups. 39,847 of them (13.3%) resolved to defense contractors, military-adjacent parent companies, or headquarters within a few miles of named bases.
I wasn't hunting for that.
I was just trying to clean a CRM.
The same day, lina published a post about hijacking zones and accidentally logging hundreds of thousands of phone calls to military bases.
Different protocol, same smell: an infrastructure lookup that was supposed to be boring turned into a classified-adjacent data spill.
That parallel is what made me sit down and write this.
Here is the exact call I used, with the live response for so you can see the shape of the data before I explain what went wrong.
The response I got back looked like this.
It is a cached sample from a real call — the endpoint was asleep when I drafted this, but the fields are exactly what the pipeline consumed.
The Finding I started the job because a sales team had 300,000 stale domain records and wanted company names, headcounts, and a rough health score for each.
The plan was simple: call the lookup endpoint, write the JSON to a warehouse, and let the CRM absorb it.
I expected a few weird results.
I did not expect one in eight records to touch the defense sector.
The pipeline flagged a record as "military-adjacent" if any of three things matched: contained a name on a defense-contractor watchlist fell inside a 25-mile radius of a named US military installation contained keywords like "Defense," "Aerospace," "National," or "Federal" That last rule was the laziest, and it showed. matches were the biggest bucket.
Microsoft, Amazon, Alphabet, and Oracle all appeared dozens of times because they sell cloud services to government agencies.
A domain belonging to a two-person Azure consultancy would come back with and immediately land in the defense queue.
Headquarters matches were almost as noisy.
Roswell, New Mexico showed up repeatedly.
Roswell is not just the UFO town; it is also near White Sands Missile Range, where US personnel were running a GPS jamming exercise this past May.
That exercise forced a medevac King Air to revert to old navigation and crash into a mountain — the first time GPS jamming contributed to a civilian plane crash in the United States.
When your company-enrichment pipeline treats geographic proximity as a signal, geography starts reading like a threat map.
The story from lina's blog made the pattern feel less like a coincidence.
ENUM was an early-2000s idea: reverse a phone number, dot the digits, append , and let carriers route calls over SIP instead of the PSTN. becomes .
It never really took off, but the delegation infrastructure stayed alive.
An expired nameserver let lina take over zones for entire territories and log call metadata that included military bases.
The lookup layer was innocent.
The consumer of the lookup layer was not.
That is more or less what happened to my CRM cleanup.
The Data The API returns a rich company profile: Wikipedia summary, Wikidata tags, SEC EDGAR pointers, a GitHub org fingerprint, UK Companies House data where available, CEO and founders, and a from 0 to 100 built from six free signals.
For the score was 78, the GitHub org had 200 repos, 50,000 stars, and 12,000 followers, and the company was listed as having 3,000+ employees since being founded in
2008.
Those numbers are useful for sales scoring.
They are useless for deciding whether a domain belongs on a restricted list.
I built the batch runner in Python.
It read a CSV of domains, called , and wrote every response to Parquet.
The lookup itself was fast — most calls returned in under two seconds.
The expensive part was the classifier I wrapped around it.
The classifier had four rules.
Three of them were naive string matches.
The fourth was a hand-curated radius list pulled from public DoD installation coordinates.
None of them understood context.
The API does not mark a company as military or civilian.
It just tells you that the headquarters is in San Francisco, the parent company is Microsoft, or the CEO is Thomas Dohmke.
The consumer has to decide what those facts mean.
That is where I burned myself.
On July 30, 2026, the API returned and for .
My matcher saw "Microsoft," remembered that Microsoft has Azure Government contracts, and dropped the record into the defense-contractor queue.
It cost us three hours of review and one very nervous Slack thread.
There is no clean lesson here.
The string match worked exactly as written.
The data was correct.
My assumption was the bug.
The false positive rate on was brutal.
Microsoft alone accounted for thousands of flagged records because any subsidiary, reseller, or partner using Azure came back with that parent.
Amazon was almost as bad.
Alphabet and Oracle followed.
A Nikkei Asia investigation published the same week noted that just five US tech giants (Alphabet, Microsoft, Amazon, Meta, and one other) are pouring untold billions into enormous data centers and carrying a mountain of off-balance-sheet debt.
Those same five names are so large that they blur into almost every industry, including defense.
When you treat parent-company metadata as a trust signal, you inherit every contract that parent has ever signed.
Headquarters matches were more subtle and, in some ways, worse.
A company headquartered in Roswell was flagged because of White Sands.
A company in Huntsville, Alabama was flagged because of Redstone Arsenal.
A company in Arlington, Virginia was flagged because of the Pentagon.
None of those headquarters choices mean the company is classified.
They often mean the company is near a cheap airport, a university engineering program, or a former military town with a skilled workforce.
My radius rule turned ordinary geography into a suspicion score.
The GitHub sample is a good illustration of why this matters. has a of 78, which looks healthy.
Its metrics are strong: 200 repos, 50,000 stars, 12,000 followers.
The company is headquartered in San Francisco and owned by Microsoft.
If I had sold that record to a compliance team as "potential defense contractor," I would have been laughed out of the room.
But at scale, with 300,000 records and a keyword matcher, the laughable cases become a flood.
I also saw the inverse problem: real defense-adjacent records that the API returned without any obvious flag.
A small LLC doing RF engineering for the Navy came back with a generic company name, no parent company, and a headquarters in a bland suburban office park.
Nothing in the JSON said "military." My classifier missed it entirely.
So the pipeline was simultaneously over-flagging GitHub and under-flagging actual contractors.
That asymmetry is the heart of the failure.
Enrichment APIs give you surface facts.
They do not give you intent.
A field is a corporate-ownership fact, not a security clearance.
A field is an address, not a mission statement.
When you chain those facts into a compliance or targeting workflow, you are doing classification work that the API never promised to do.
The same week I was running this job, Anna’s Archive published a warning that AI companies are destroying physical books to train models and urged people to scan rare books before it is too late.
The connection is not technical; it is about appetite.
Once a data pipeline is cheap and automated, it consumes things that were never meant to be consumed at that scale.
Phone-call routing metadata, company headquarters, book pages — the infrastructure treats them all as feedstock.
The harm shows up downstream.
The Analysis Keyword matching on and is overrated.
It feels like a quick win until you run it over six orders of magnitude and watch Microsoft show up as a defense contractor 4,000 times.
The deeper issue is that company enrichment is surveillance-adjacent infrastructure dressed up as sales intelligence.
A domain-to-company lookup seems harmless because every SaaS product does it.
You type