> when a carrier does an ENUM lookup for one of these numbers, they're essentially asking "where do I route this call?", and I could answer with whatever I wanted. I could point it at my own SIP server, accept the incoming call, and then place an outgoing call to the real destination with a spoofed number
How would the “outgoing call to the real destination” avoid this same lookup? Directives to route around the ENUM system?
How would the “outgoing call to the real destination” avoid this same lookup? Directives to route around the ENUM system?