Summary
- Cory Solovewicz says noreply.net and noreply.us have received hundreds of thousands of messages unintentionally sent by organisational systems.
- Mike Sheward has observed similar leakage through deleted-user style domains, including meeting invitations from a UK government agency.
- The exposure is created by automated workflows and account-lifecycle practices that treat externally registrable domains as if they were safe disposal addresses.
Organisations are sending corporate and personal information to internet domains they do not control because automated systems and account-deprovisioning processes are treating plausible-looking email addresses as if they lead nowhere.
Security researcher Cory Solovewicz has spent several years receiving messages intended for other people after acquiring the domains noreply.us and noreply.net. What began as a privacy experiment developed into an accidental collection point for automated messages containing business information, account details, attachments, and personal data.
WIRED reported that noreply.net had received more than 400,000 messages during roughly a year and a half of Solovewicz’s ownership, including 28,365 messages containing attachments. The older noreply.us domain had received more than 37,000 messages since 2020. Across the month before his DEF CON presentation, the two domains received more than 11,000 messages.
The messages originated from more than 6,200 root domains, according to Solovewicz’s figures. Examples described in the report included service orders, school account messages, injury reports, and credentials for test platforms.
The problem is not limited to variations of “no reply”. Mike Sheward, head of security at electric-vehicle charging company Xeal, bought deleteduser.com earlier this year and said three different organisations had sent messages to addresses at the domain within the first hour.
Sheward subsequently acquired other domains resembling placeholders used for deleted or deprovisioned users. He told WIRED that messages received across those domains have included work approvals, leave requests, hotel bookings, and meeting invitations. A UK government agency was among the organisations that sent invitations to online meetings.
The exposures differ from conventional phishing or mailbox compromise. The researchers did not need to breach the organisations sending the information. Mail systems delivered the material to valid external domains because addresses had been configured as placeholders, replacements, or supposed dead ends without checking who controlled the destination.
That moves the weakness into identity lifecycle management and application design. When an employee leaves, an account is deleted, or an application no longer knows where a notification should go, replacing an address with something resembling deleteduser@external-domain can appear administratively convenient.
If the domain is publicly registrable and owned by somebody else, however, the information has not been discarded. It has been routed to an external recipient.
Automation makes the effect persistent. Approval systems, monitoring services, software platforms, booking tools, and scheduled workflows can continue producing messages long after the configuration decision that created the incorrect address has been forgotten. One misplaced identity can therefore generate an ongoing stream rather than a single disclosure.
The researchers’ figures also suggest the issue is not confined to a handful of configuration mistakes. Solovewicz said he had scanned 7,136 possible placeholder-style domains and found 328 configured with catch-all inboxes, although that finding does not establish that all of them are receiving sensitive organisational mail.
Neither researcher’s work establishes that criminal groups are systematically registering comparable domains for data harvesting. Solovewicz and Sheward have instead acquired more than 30 such domains between their separate efforts and have been notifying affected organisations where practical.
The underlying opportunity is nonetheless straightforward. Registering a domain can turn a supposedly dead address into a live external mailbox without requiring the owner to compromise the sender’s infrastructure or credentials.
The problem sits across application configuration, offboarding, workflow design, domain governance, and the assumptions developers make about non-deliverable addresses. Reserved namespaces such as .invalid exist specifically so that addresses cannot resolve as ordinary public domains, but the continuing leakage described by the researchers shows that plausible external domains are still being used as substitutes.
The result is an unusually mundane form of data exposure. The mail server can operate exactly as designed, authenticate the sender correctly, and deliver the message successfully — while the information still ends up with the wrong organisation.
