A researcher bought noreply.net. Companies started sending him secrets.
Companies treat some email domains as digital trash cans, despite the risks.
Cory Solovewicz, a security researcher and consultant, has been inundated with an unprecedented number of emails since December 2024. His domain, noreply.net, has received 401,796 messages, averaging 699.99 per day. These emails are not typical spam or newsletters, but rather, they contain private information and company secrets that companies and organizations have mistakenly sent to Solovewicz.
The researcher, who purchased noreply.us and noreply.net in 2020 and 2024, respectively, initially intended to use these domains as a catch-all email to filter messages and enhance his privacy. However, he soon realized that his domains had become an accidental honeypot, collecting sensitive data from various entities. Among the peculiar emails he has received are injury reports from a city government, confirmation of people's pizza orders, and account setup emails from a school platform.
Solovewicz tells WIRED, "I get service orders for people that need repairs. I get lots of test platform credentials."
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
