Security Researchers Reveal Thousands of Companies Leak Secrets to ‘No Reply’ Email Addresses

How Placeholder Email Addresses Became Accidental Data Sinks

Security researcher Cory Solovewicz bought the domain noreply.us in 2020 as a personal catch-all for privacy. He later added noreply.net. Instead of filtering his own mail, the domains began receiving a torrent of automated messages from companies that had mistakenly configured their systems to send email to addresses like @noreply.com or @noreply.net—assuming those addresses went nowhere.

Solovewicz has logged 401,796 messages to noreply.net in roughly 18 months, including 28,365 with attachments. Injury reports from a city government, account setup links from a school platform, and service repair orders have all landed in his inbox. He describes it as “an accidental honeypot.”

At the Defcon security conference this week, Solovewicz revealed the scale of the problem. Co-researcher Mike Sheward, head of security at EV charging firm Xeal, spent about $15 on deleteduser.com and received emails from at least 100 organizations within the first hour, including Zoom invitations from a UK government agency, hotel booking details with full names, and even CCTV stills from an AI company monitoring industrial safety in the Middle East.

Both researchers say they are relieved they, rather than criminals or nation-state actors, acquired the domains. They have bought more than 30 similar domains to block abuse, and they are urging companies to audit and fix the misconfigurations that turn placeholder addresses into open data sinks.

Why Systemic Email Misconfiguration Persists Across Industries

The Mechanics of the Leak

When an employee leaves or an account is deleted, many organizations simply change the associated email address to a dummy like “[email protected]” or “[email protected]” rather than fully removing it. Automated systems then continue dispatching alerts, reports, and confirmations to that address. If the domain is publicly available and owned by a third party with a catch-all inbox, every message lands in a real mailbox. Neither noreply.net nor deleteduser.com is owned by the sending companies; both were cheap pickups by researchers. The absence of any authentication or domain verification on the receiving side makes the problem invisible until someone checks.

A Systemic Failure, Not a One-Off Bug

Solovewicz’s scans show that 328 of 7,136 domains he probed had catch-all inboxes configured—suggesting the issue may be far larger than the 6,200 sending root domains identified in his own data. The practice cuts across industries: the researchers have seen emails from cybersecurity firms, Microsoft partners, government agencies, and industrial AI companies. The common thread is a false assumption that “no-reply” and “deleted user” addresses are dead ends, when in fact they are simply unowned or unmonitored public resources.

The Disclosure Dilemma and Mixed Corporate Response

Both researchers attempted to notify affected organizations. Some quietly fixed the problem, but many did not reply, and the sheer volume makes it impossible to alert every company. Solovewicz says it would be a full-time job. He frames his public talk as a form of “responsible disclosure” designed to force systemic change. The mixed response underscores a broader cultural gap: automated outbound email auditing is rarely a priority until a breach occurs. The risk is not theoretical—the same domains could have been acquired by an extortionist who might quietly harvest credentials, customer lists, and internal documents for months.

What Security and IT Leaders Must Do to Plug the Leak

• Audit outbound email flows now. Scan SMTP logs and application email calls for any messages sent to public domains like noreply.net, deleteduser.com, or similar placeholders. Check that no system substitutes a real user’s email with a made-up address on a domain you don’t control.
• Replace dummy addresses with proper industry practices. Use addresses ending in .invalid—a top-level domain reserved by IETF that will never resolve—or route internal messages to a domain you own and monitor. Never rely on an unregistered public domain as a black hole.
• Verify that account deactivation truly ends email traffic. When an employee leaves or a customer deletes an account, ensure all mailing lists, automated reports, and alert systems are updated or disabled. Test by re-entering a deactivated handle into your own systems to confirm no messages leak.
• Check your own domains for catch-all configurations. If you own a domain that is used as a placeholder—even internally—disable the catch-all unless absolutely necessary, and monitor its inbox. Solovewicz’s scan found 328 domains out of over 7,000 were wide open.
• Engage a third-party email security audit. Given the scale and blind spots, an external review of email routing and configuration can identify leaks that internal teams miss. The researchers’ work creates a tactical business case for such assessments.