Security
Abandoned email domains are becoming data traps
Researchers say abandoned email domains are receiving credentials, medical details, bookings, and CCTV images from misconfigured company systems.
A pair of security researchers have turned abandoned-looking email domains into accidental data traps—and found that companies are still sending private information straight into them.
Since December 2024, security researcher and consultant Cory Solovewicz says one of his domains has received 401,796 messages, or an average of 699.99 emails per day. The messages include injury reports, pizza-order confirmations, school-platform account credentials, repair requests, and other records intended for people or organizations that no longer control the apparent destination.
Solovewicz owns noreply.us and noreply.net, domains he purchased in 2020 and 2024. He originally planned to use noreply.us as a catch-all address for privacy testing. Instead, he discovered that automated systems were treating addresses on the domains as if they were valid—or assuming that “no reply” meant nobody could read the mail.
“I created an accidental honeypot. I had no idea it was going to turn into this.”
— Cory Solovewicz, security researcher and consultant
How abandoned email addresses become data leaks
Organizations commonly use addresses such as companyname@noreply.net or other placeholder-style domains for automated messages. In some cases, systems appear to transform a user’s existing address after that person leaves a company or deletes an account, rather than removing the address completely.
The result is not merely unwanted mail. Solovewicz says the messages have exposed customer information, employee data, internal records, and company secrets. The emails are generated by automated systems rather than written individually by employees, making the problem a matter of configuration and account-lifecycle failures rather than an isolated human mistake.
The volume is substantial. Solovewicz says noreply.net received about 400,000 messages during the roughly year and a half he has owned it, including 28,365 messages with attachments. His older noreply.us domain received 37,255 messages over 2,345 days. Together, the domains received more than 11,000 messages in the month before his conference presentation.
The mail came from more than 14,000 “from” addresses across 6,200 root domains, according to Solovewicz’s figures.
The basic fix is straightforward: companies can use internal domains for discarded addresses or the .invalid domain, which is guaranteed not to exist. The fact that the failure is avoidable makes the continued leakage more serious, not less.
What researchers are receiving
Solovewicz is not the only researcher monitoring this kind of misconfiguration. Earlier this year, Mike Sheward, head of security at EV charging company Xeal, spent about $15 to buy deleteduser.com. Within an hour, he says, three organizations had sent messages to addresses at the domain.
Across several domains, Sheward has received thousands of unintended emails from at least 100 organizations, including:
- Viagra order details
- Hotel bookings containing people’s full names
- Requests to approve work vacations or leaves of absence
- Zoom meeting invitations from a UK government agency
- Invitations to a San Francisco company’s summer barbecue addressed to “Dear Deleted User”
Sheward also says an AI company that uses object-recognition technology to identify workers at industrial sites in the Middle East who may be violating safety protocols has sent thousands of CCTV stills to one of his domains. The company was not named.
That kind of material illustrates why the domains could become valuable targets for criminals. The researchers have independently purchased more than 30 domains to reduce the chance that attackers will discover and exploit the same failure mode first.
The problem may extend far beyond two domains
Solovewicz used his Defcon presentation to describe a probe designed to check whether other potential placeholder domains accept catch-all email. He says he scanned 7,136 domains and found 328 configured with catch-all inboxes.
That scan does not establish how many organizations are leaking sensitive data, and the reporting does not include an independent audit of the researchers' full totals. Solovewicz and Sheward have also declined to publicly identify the affected entities, so readers cannot verify which companies or government bodies remain exposed.
Both researchers say they notify organizations where possible. Some appear to have quietly corrected their systems; many others have not responded. Solovewicz says the workload has become too large to manage as a side project.
“You guys need to fix your systems and not do this and not leak your customer data and your employee data and your own internal data.”
— Cory Solovewicz, security researcher and consultant
The practical lesson is unusually clear: a “no reply” address is not a security control, and an abandoned account is not safely deleted if automated systems can still route mail to it. The researchers' evidence points to a broad, preventable exposure, but the identities of the affected organizations—and the full scale of the leak—remain unsettled. Until companies stop using real, deliverable domains as discard bins, sensitive data will continue to arrive wherever those domains happen to be owned.
Source: Wired