He Bought the Domain noreply.net — and Companies Flooded Him with Other People's Secrets

Cory Solovewicz gets more unwanted mail than you do. Since December 2024, one of his domains has received 401,796 emails — nearly 700 a day on average. But this isn't spam or newsletters: companies and organizations are mistakenly sending him other people's personal data and internal secrets.

Among what has arrived: injury reports from a city government, pizza order confirmations, account-setup messages for a school platform, repair requests, and heaps of test credentials. The reason is simple: Solovewicz owns noreply.us (bought in 2020) and noreply.net (2024). After setting up a “catch-all” mailbox that accepts mail sent to any address at the domain, he discovered that third-party systems were sending messages there en masse.

“I accidentally created a honeypot,” he tells WIRED. “I had no idea what it would turn into.”

A digital dumpster

Companies send mail to addresses like companyname@noreply.net, assuming it goes nowhere and is monitored by no one. Sometimes they do the same thing when an employee leaves or an account is deleted: the person's real address is simply swapped out for a placeholder, without the data being removed from the system.

According to Solovewicz, noreply.net is the largest of his domains: over a year and a half it received roughly 400,000 emails, 28,365 of them with attachments. In all, the messages came from more than 14,000 addresses and 6,200 root domains — and every one of them is generated automatically rather than written by a human.

The problem is nothing new. Nearly twenty years ago, journalist Brian Krebs wrote about how companies were sending millions of emails to @donotreply.com. And it's easy to avoid: just use internal domains or the reserved .invalid domain, which is guaranteed not to exist.

He's not alone

Solovewicz isn't the only guardian of the internet's dumpster. Mike Sheward, head of security at the company Xeal, bought the domain deleteduser.com for about $15. “Within the first hour, three different organizations sent something to @deleteduser.com,” he says. His inbox turned up Viagra orders, vacation-approval requests, hotel bookings with full names, and a Zoom meeting invitation from a British government agency. One of the most prolific senders is an AI company that identifies safety violators at industrial sites in the Middle East: Sheward received thousands of freeze-frames from surveillance cameras.

Realizing the scale of it, the two researchers independently bought up more than 30 domains apiece, so that such addresses wouldn't fall into the hands of bad actors. Solovewicz, who gave a talk at the Defcon conference, built a scanner: of 7,136 domains checked, 328 turned out to have catch-all mailboxes configured. He's convinced this is only the tip of the iceberg.

Both try to warn companies about the misconfigurations, but the results are mixed: some quietly fix everything, while many don't respond. “It's just too much,” Solovewicz says. “Handling every case would be a full-time job. Don't assume no one is monitoring a domain. Fix your systems and stop leaking other people's data.”

Source: Ars Technica