Security researcher Cory Solovewicz owns noreply.us and noreply.net, and companies keep sending them other people’s private information. Since December 2024, noreply.net has received about 400,000 messages, 28,365 of them with attachments, he told WIRED before presenting the findings at Defcon.
He bought the older noreply.us in 2020 and set it up as a catch-all inbox, which accepts mail sent to any address at the domain, to filter his own email. Automated systems soon began delivering mail there. “I created an accidental honeypot,” he said. “I had no idea it was going to turn into this.”
That domain has logged 37,255 messages over 2,345 days. In the month before his talk, the two domains together took in more than 11,000 emails, and overall the mail has come from more than 14,000 sender addresses at 6,200 root domains. Solovewicz said it is machine-generated, not written by people. Among it: injury reports from a city government, pizza order confirmations, account setup emails from a school platform, repair service orders and “lots of test platform credentials.”
Why it happens
Organizations send mail to addresses such as [companyname]@noreply.net assuming nobody receives it, WIRED reported, and some systems rewrite a person’s address to a placeholder domain when they leave a company or delete an account. The fix is simple: use domains the company controls, or the .invalid domain, which is guaranteed not to exist. The problem isn’t new. Almost 20 years ago Brian Krebs, then at the Washington Post, wrote about companies sending millions of messages to @donotreply.com addresses.
Solovewicz isn’t the only one collecting this mail. Mike Sheward, head of security at EV charging company Xeal, paid about $15 for deleteduser.com earlier this year, and within the first hour three organizations had emailed it. Across his domains Sheward has received mail from at least 100 organizations, including Viagra orders, leave requests, hotel bookings with guests’ full names, Zoom invitations from a UK government agency, and thousands of CCTV stills from an AI company that monitors industrial sites for safety violations.
“I am being a good guardian of the internet dumpster—but if I had been a bad one, it’s not hard to see how this information that is willingly thrown at my face could be misused,” Sheward wrote in a Medium post in April. Working independently, the two have bought more than 30 domains so attackers can’t copy the approach.
How widespread it is
For his Defcon talk, Solovewicz built a probe to test other placeholder-style domains. “I’ve scanned 7,136 domains, and 328 of them were identified as having catch-all inboxes configured,” he said.
Both researchers have been notifying companies, with mixed results, according to the report, which Ars Technica republished. Some organizations appear to have fixed the problem; many have not replied. “I’m at the point where this would now be a full-time job to handle every single one of these,” Solovewicz said.
WebProNews is an iEntry Publication