Our resolvers look up names for the customers' machines and cache what they find, and the cache is logged and clears when a record expires. One resolver answers, every night from midnight to one, for a domain that has not existed since 2019. The answer points at an address in our own hall that is not allocated. And if you go to it, in that hour, there is a page, and the page is a fourteen year old's website about trains, and the last post is dated tonight.
I am the network services engineer at a data centre and the resolvers are the most boring machines I own, which is why I noticed.
The resolvers.
Four servers that turn names into addresses for everything in the building. They cache answers, and the cache is logged, and the log shows where every answer came from. A name that does not exist comes back as no such domain, and that is logged too.
One resolver answers, every night, for a name that does not exist.
The name.
A domain, a personal one, the kind a kid registers with birthday money. The registry says it expired in 2019 and was never renewed and is not registered to anybody. The other three resolvers say no such domain. The fourth says an address. From midnight to one. From cache, the log says, with a time to live that never counts down, and at one it stops answering and the cache entry is gone and at midnight it is back.
The address is in our own range. It is not allocated. There is nothing on it. The switch shows no device with it. And for that hour, if you point a browser at it, from inside the building, a page loads.
The page.
A website a boy made. I am going to say that plainly because there is no other way to say it. A homepage with a title in a font that was popular, a photograph of a railway station, a list of links: locomotives, timetables, my photos, about me. The about me page says he is fourteen, and the town he lives in, which is this town, and that he wants to be a signalman.
The posts are dated. The old ones run from 2016 to 2019 and stop in the spring of 2019 with a post about an exam. And then there is one more, every night, at midnight, with tonight's date, and it is a paragraph about a train he saw that day, and the train is always one that runs through this town, and it is always one that ran today, because I have checked, and the paragraph is in the voice of a fourteen year old who loves trains, and the voice has not got any older.
What has been checked.
The resolver, rebuilt from nothing. It answers at midnight.
The address, by me, with a laptop in the hall at half past midnight, plugged into the switch that should have it. The page loaded. The post for tonight was about the late freight, which had gone through at eleven, and which I had heard from the car park, and the boy had written that he had counted the wagons and there were thirty one, and I had not counted, and the next night I did, and he was right.
Who.
The about me page has a first name and a town and a year, and the town is small, and the paper has a boy with that first name in the spring of 2019, and I am not going to write down what happened, except that it was not an accident, and that he was fourteen, and that the paper said he had loved trains.
The domain expired the year after because there was nobody to renew it.
He is still posting. Every night, about the train he saw, from a resolver that has no business answering for him, on an address nobody gave him, in my hall.
What is done about it.
The cache anomaly is on the resolver report and the security team have asked whether we have a rogue host on an unallocated address serving web content, which is the exact sentence they used, and I have said yes, and they have asked me to find it and remove it, and I have said I am looking, which is true.
What I do.
I run the resolvers.
A domain can be registered by anybody if it is free, and it is free, and I registered it, in my own name, on my own card, and I pointed it at our range, at the address, with the other three resolvers told to answer for it too, so that from midnight to one the name works from anywhere, not only from inside our hall, because a boy who builds a website wants somebody to see it.
I have not put anything on the address. There is nothing to put. The page is there, at midnight, or it is not.
It is. And the site has a counter, the old kind, at the bottom of the homepage, that counts visitors, and it said a number in the hundreds when I first saw it, which was the number it had reached in 2019, and it is going up now. Slowly. A few a night. People who have found it, from wherever they find things, who are reading about the late freight and the thirty one wagons, and one of them has left a comment, which the site allows, and the comment says, great site mate, keep it up, and the next night's post began, thanks, and I sat in the hall and read that for longer than I have read anything.