Security researcher Cory Solovewicz registered the domain noreply.us in 2020 and noreply.net in 2024, initially intending to use them for personal privacy experiments. He soon discovered that automated corporate systems were sending a high volume of emails to these addresses, treating them as valid destinations. Solovewicz described this outcome as an "accidental honeypot," as the mail systems of various organizations resolved the domains and delivered messages, contrary to the common assumption that "noreply" addresses lead nowhere.
Since December 2024, the noreply.net domain alone has received approximately 400,000 messages, including over 28,000 attachments. These messages originate from more than 14,000 sending addresses across 6,200 root domains. The content of these emails has ranged from city government injury reports and pizza order confirmations to school platform sign-ups and credentials for test environments.
Mike Sheward, head of security at EV charging company Xeal, conducted a similar experiment. He purchased deleteduser.com for approximately $15 in 2026. Within the first hour, his domain received emails from three different organizations. Since then, Sheward has collected messages from at least 100 organizations, including leave approval requests, hotel bookings with guest names, Zoom invitations from a UK government agency, and thousands of CCTV stills from an AI vendor monitoring worker safety at Middle East industrial sites.
This phenomenon stems from a common misconfiguration in corporate email systems. Instead of fully deprovisioning an account or routing messages to a controlled internal domain, many systems simply rewrite the user's address to a placeholder domain that the company does not own. Companies often treat these "noreply" or "deleteduser" addresses as digital trash cans, assuming the emails will simply vanish. However, if these domains are publicly available for registration, anyone can acquire them and begin receiving potentially sensitive information.
The exposed material includes a wide array of confidential data, such as customer information, employee data, internal records, and corporate secrets. The messages are machine-generated, indicating that the problem lies in systemic configuration and account lifecycle management rather than isolated human error.
The researchers presented their findings at the Defcon security conference. Solovewicz and Sheward have since acquired more than 30 such domains to prevent malicious actors from exploiting this vulnerability. Solovewicz also tested over 7,000 potential placeholder domains and found 328 that were configured with catch-all inboxes, suggesting the scale of the problem is substantial.
This issue is not new; Brian Krebs documented a similar failure with donotreply.com nearly two decades ago. Organizations have clear alternatives to prevent these leaks, such as using internal domains for discarded addresses or employing the reserved .invalid namespace, which is guaranteed not to resolve. The researchers have notified affected organizations, but many have not responded, and no public record indicates which companies have remediated their systems.