Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All
Two security researchers bought cheap domains—including noreply.net and deleteduser.com—and set up email listening services. Hundreds of companies are sending them corporate secrets.
Cory Solovewicz, a security researcher and consultant, has amassed a staggering 401,796 emails over the past year and a half by owning the domains noreply.us and noreply.net. These domains serve as unwitting catch-all email systems, receiving sensitive information from various companies and organizations. Solovewicz, who initially created the domains as a privacy-enhancing measure, now sees them as a valuable tool to warn businesses and groups of misconfigured systems that are inadvertently sharing private data.
Emails like injury reports from city governments, confirmation of pizza orders, and account setup notifications have flooded Solovewicz's inbox. He attributes this influx to companies and organizations sending messages to addresses like @noreply.us or similar variations, believing the emails will be filtered out or remain unnoticed. The researcher believes the issue is preventable, suggesting that companies use internal domains or the .invalid domain, which is guaranteed not to exist.
The scale of the problem is alarming, with Solovewicz estimating that over 14,000 "from" addresses have sent emails to his domains, originating from 6,200 root domains. The messages are automated by company systems, not written by humans. While the issue is not new, Solovewicz stresses that it is entirely avoidable by using alternative configurations.
In a similar vein, Mike Sheward, the head of security at EV charging company Xeal, purchased the domain deleteduser.com for a similar purpose. Within an hour, Sheward received emails from various organizations containing information such as Viagra orders, work vacation requests, hotel bookings, and Zoom meeting invitations. Sheward has now acquired over 30 domains to help prevent malicious actors from exploiting the data.
Both Solovewicz and Sheward work independently to limit the potential for hackers and extortionists to misuse the data they've gathered. They have built probes to test other placeholder domains and have already identified 328 catch-all inboxes out of 7,136 domains they've scanned. Solovewicz remains concerned that the problem may be far larger than he initially realized, cautioning that what he's found is just the tip of the iceberg.
Written by urgent.news from Wired's reporting — not their text. Machine-written; read the original for the full account.