There is a domain named noreply.net, which literally translates to “do not reply.” Registered long ago, it sat unused for years. In 2024, American security researcher Cory Solovewicz bought it and configured a catch-all email handler for the domain. Over the next year and a half, companies around the world automatically began streaming emails into his inbox: municipal workers’ injury reports, school account activation emails, pizza order confirmations, repair work orders, test platform credentials, and a massive volume of internal documents, invoices, contracts, and password reset links. By the time he presented his findings at Defcon—the world’s premier hacker conference—the domain had collected 401,796 emails, averaging roughly 700 per day, with 28,365 containing attachments.
Not a single one of these emails was written by a human; all were generated automatically by corporate software systems. Solovewicz noted that he initially just wanted a personal address for blocking spam, saying he “accidentally built a honeypot.” In cybersecurity, a honeypot is a trap set to entice attackers by leaving bait exposed. This time, however, the trap caught corporate systems belonging to some of the world’s most security-conscious organizations.
Figure: In the eyes of enterprise IT, placeholder domains serve as digital trash cans—places presumed unread where anything can be dumped. Source: Ars Technica (Photo: Richard Drury via Getty)
Why an “Unwanted Domain” Receives Corporate Secrets
To understand how this happens, two key pieces of context are necessary.
First, countless software applications use [email protected] as their default sender address, intended to signify that no response is monitored. During deployment, many organizations take shortcuts, adopting default configurations wholesale or even specifying noreply.net—a real, active domain they do not own—reasoning that no one reads replies anyway. Similarly, when employees leave or accounts are deleted, automated routines often rewrite original addresses into placeholders like [email protected] instead of properly purging the records.
Second, the email system itself has been running for over 50 years, dating back to the first email sent in 1971 and protocol standardization in the early 1980s. From inception, the protocol strictly verifies only one piece of information: the recipient address, because routing depends on knowing where to deliver the message. Sender identity was left entirely unverified by design—whatever string is provided is accepted. Email is fundamentally a postcard: the postal service routes it solely by destination address, never validating the return identity.
When these two realities collide, a massive vulnerability emerges. Companies send sensitive data to addresses explicitly labeled unmonitored yet actively collected; mail servers verify the destination, confirm its validity, and complete delivery. Nowhere along the line does any component verify sender ownership or domain authorization. The implicit trust model underpinning 50 years of digital communication collapses.
That trust assumption held when the network comprised only trusted university and military research nodes. As email opened to the public, the lack of sender verification bred rampant spoofing—phishing emails claiming to come from “Your Bank” or “Your Boss.” The security community later introduced SPF, DKIM, and DMARC to authenticate sender domains. But those safeguards cannot catch this type of leak: the sending domain is completely legitimate; only the recipient address is misconfigured—and recipient validation is the only check email servers actually perform.
Figure: Illustration from WIRED illustrating sensitive corporate information continuously flooding ‘no-reply’ mailboxes. Source: WIRED (Illustration: Jobanny Cabrera)
What 400,000 Emails Represent
Solovewicz tallied incoming messages from over 14,000 sending addresses across 6,200 apex domains. The numbers demonstrate an industry-wide blind spot of extraordinary proportions—a steady leak operating continuously at 700 messages a day.
Fellow researcher Mike Sheward spent roughly $15 to purchase deleteduser.com. Within the first hour, three separate organizations began delivering mail to the domain. His findings were even more startling: employee leave requests, hotel reservations with full guest names, Zoom meeting invites from UK government agencies, and a summer barbecue invitation from a San Francisco firm addressed to “Dear Deleted User.” The most prolific sender was an AI firm using image recognition to monitor helmet compliance on Middle Eastern construction sites, which transmitted thousands of surveillance snapshots. Sheward described himself as a “curator of internet garbage”—garbage bin being precisely how enterprises treat such domains. Messages with attachments posed particular risks: 28,365 attachments meant spreadsheets, scanned documents, and screenshots, often far more valuable than plain text body content.
$15, one hour, three organizations. This may set a record for the lowest-cost data leak in history.
Realizing the potential value to malicious actors or extortionists, the pair registered over 30 similar placeholder domains to preempt malicious acquisition. Solovewicz subsequently scanned 7,136 candidate placeholder domains, discovering 328 configured with active catch-all mail servers. As he noted, his accidental discovery likely represents only the tip of the iceberg.
A Leak Without Hackers
No exploits were executed in this incident, and no malicious threat actors were involved. The root causes were simply “default settings” and “lack of verification.” Automated pipelines blindly dispatched confidential data to placeholder domains; email protocols trusted every declared identity; and an enterprise ecosystem reliant on email rarely audited where outgoing messages actually landed.
This phenomenon is not entirely new—journalist Brian Krebs reported two decades ago on corporate systems sending torrents of mail to donotreply.com. Twenty years later, the problem remains intact. Solovewicz spent months notifying affected companies, meeting with mixed results: while some remediated silently, many never responded. He acknowledged that handling notifications had become demanding enough to constitute a full-time job.
Remediation is straightforward: configure internal enterprise domains, utilize reserved non-routable domains like .invalid, and regularly audit outbound email logs. The real hurdle is mindset—convincing organizations that every automated email sent into the void might be read by a complete stranger.
Email, a 50-year-old foundational technology, continues to power global business, but its original trust assumptions no longer match the reality of today’s internet. Even as this article is being written, dozens of new “confidential” emails are likely landing in that catch-all inbox.
Reference Links:
- Ars Technica: A researcher bought noreply.net. Companies started sending him secrets.
- WIRED: Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All
- Lobsters discussion (lobste.rs/s/exgfc0, 27 points)
