I Ran 300K Company API Lookups. 40K Hit Military Bases.
security, #api, #cybersecurity, #discuss On July 30, 2026, my batch job finished 300,000 domain-to-company lookups. 39,847 of them (13.3%) resolved to defense contractors, military-adjacent parent companies, or headquarters within a few miles of named bases. I wasn't hunting for that. I was just trying to clean a CRM. The same day, lina published a post about hijacking e164.arpa zones and…
On July 30, 2026, the reporter ran a batch job that performed 300,000 domain-to-company lookups through an API. Of those calls, 39,847 (13.3%) resolved to defense contractors, military-related companies, or headquarters near military bases. The reporter was simply trying to clean a CRM when this issue arose. The same day, another post was published about hijacking e164.arpa zones, which led to accidental logging of thousands of phone calls to military bases.
The reporter used a specific API call to demonstrate the issue, showing that a simple lookup of github.com revealed a parent_company of Microsoft, which led to the company being flagged as a potential defense contractor. The API response included various company details such as Wikipedia summary, CEO, founding year, and employee count.
The reporter built a Python pipeline to read a CSV of domains, call the lookup endpoint, and write the responses to a Parquet file. However, the classifier used to determine if a company was military-related relied solely on string matches and geographic proximity, without understanding context. This led to numerous false positives, particularly with parent_company matches from companies that used Microsoft services.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
