The Accidental Custodians of Corporate Data Leaks: How Misconfigured Email Domains Create Massive Privacy Vulnerabilities

Cory Solovewicz receives more unwanted, sensitive information than almost any private citizen in the world. As the owner of the domains noreply.us and noreply.net, Solovewicz has inadvertently transformed his digital assets into high-traffic conduits for corporate and government data leaks. Since December 2024 alone, the noreply.net domain has processed over 401,796 messages, averaging nearly 700 pings per day. This is not a standard barrage of marketing spam; rather, it is a steady stream of internal corporate secrets, private health reports, and confidential credentials sent by automated systems that have been improperly configured to dump data into "black hole" domains.

The phenomenon, which researchers are calling an "accidental honeypot," highlights a systemic failure in how modern enterprises manage automated notifications and decommissioned user accounts. By utilizing generic, seemingly inert domain names to handle outgoing alerts, companies are inadvertently funneling proprietary data directly into the hands of independent researchers—or, potentially, into the hands of malicious actors who could exploit the data for corporate espionage, blackmail, or identity theft.

The Anatomy of an Accidental Leak

The problem typically stems from a combination of poor software engineering practices and the misidentification of domain ownership. Many organizations utilize automated systems to send transactional emails—such as password resets, pizza delivery confirmations, or internal service requests. When a system is configured to send these emails to a recipient, but the original recipient’s address is either malformed, deleted, or reassigned, the system often defaults to a "fallback" domain.

Developers, operating under the assumption that domains like "noreply.net" or "donotreply.com" are effectively non-existent or unmonitored, often hardcode these domains into their infrastructure. However, these are public, registrable domains. When researchers like Solovewicz or Mike Sheward purchase these domains, they gain control over any email sent to any address on that domain, thanks to a "catch-all" configuration.

For Solovewicz, the journey began in 2020 with the purchase of noreply.us, followed by noreply.net in 2024. What began as a personal project to filter his own digital footprint quickly spiraled into a massive security operation. He now receives injury reports from municipal governments, sensitive test platform credentials, and private repair orders for individuals across the globe.

Chronology and Escalation: From Oversight to Investigation

The issue of misconfigured "no-reply" addresses is not entirely new; it has been documented as a security risk for nearly two decades. In 2006, security journalist Brian Krebs, then writing for the Washington Post, noted that organizations were sending millions of emails to the donotreply.com domain. Despite these early warnings, the industry has failed to adopt standardized practices to mitigate the risk.

The current escalation in these leaks coincides with the increasing digitization of administrative tasks. As more companies move to cloud-based platforms and AI-driven monitoring, the volume of automated communication has surged. Mike Sheward, head of security at the EV charging firm Xeal, encountered this reality firsthand earlier this year when he purchased the domain deleteduser.com for roughly $15.

Within sixty minutes of the purchase, Sheward was receiving emails from three distinct organizations. Over the following months, the influx grew to include invitations to UK government Zoom meetings, hotel bookings containing personally identifiable information (PII), and even thousands of CCTV stills from an AI firm monitoring industrial safety protocols in the Middle East. Sheward’s experience underscores the reality that "deleted" accounts are often not actually removed from backend databases; instead, their contact information is simply modified, causing automated systems to continue pushing sensitive data to an email address that has been effectively orphaned.

Quantitative Analysis of the Data Deluge

The sheer scale of the information flowing through these domains is substantial. According to data provided by Solovewicz during his presentation at the Defcon security conference, the noreply.net domain has received approximately 400,000 messages in the last 18 months. Of those, over 28,000 contained file attachments, representing a significant potential for malware distribution or data exfiltration.

The telemetry collected by the researchers reveals the following:

• Scope of Senders: Emails have originated from more than 14,000 unique "from" addresses, spanning over 6,200 root domains.
• Frequency: In the month leading up to the Defcon presentation, the combined volume across Solovewicz’s domains exceeded 11,000 messages.
• Proactive Scanning: Solovewicz’s own internal audit of 7,136 domains identified 328—roughly 4.6%—that were configured with catch-all inboxes, suggesting that the problem is widespread and largely undetected by the organizations involved.

The Security Implications: A "Dumpster" of Liability

The primary concern shared by security professionals is not the current state of affairs, but the potential for exploitation. If these domains had been acquired by threat actors rather than security-conscious researchers, the consequences would be severe. The data available to anyone holding these domains is a treasure trove for social engineering. An attacker could use intercepted credentials to access corporate networks, use private injury or medical reports to facilitate extortion, or leverage internal communication threads to craft highly convincing phishing attacks against employees.

"I am being a good guardian of the internet dumpster," Sheward wrote in an April blog post. "But if I had been a bad one, it is not hard to see how this information that is willingly thrown at my face could be misused."

The ethical dilemma faced by these researchers is the burden of disclosure. Notifying the thousands of companies responsible for these misconfigurations is a task of Herculean proportions. Many organizations, when alerted, do not respond, or lack the internal expertise to identify exactly where the misconfiguration resides in their complex software stacks.

Standardizing a Solution: The .invalid Domain

Security experts argue that the solution is straightforward and has been available for years. The Internet Engineering Task Force (IETF) provides the .invalid top-level domain (RFC 6761), which is specifically reserved for use in contexts where a domain is guaranteed not to exist. If developers utilized .invalid for placeholder email addresses, the mail would never leave the internal network, preventing it from ever reaching the public internet or being intercepted by a domain registrar.

Furthermore, companies are encouraged to move away from using generic external domains for internal alerts. Implementing robust email validation and ensuring that decommissioned accounts are truly purged—rather than simply redirected to a non-existent alias—is essential for maintaining data privacy.

The Path Forward: Responsible Disclosure

For Solovewicz, the goal of his Defcon presentation and his continued work is to force a shift in corporate behavior. He is not interested in keeping the data; he is interested in ensuring that organizations conduct regular audits of their outgoing email configurations.

"I just want companies and organizations to do the right thing and to be auditing their systems and fixing their stuff," Solovewicz stated. The reality, however, is that this has become a full-time, uncompensated effort. As the volume of emails continues to grow, both Solovewicz and Sheward have purchased over 30 additional domains collectively, essentially acting as a firewall for the rest of the internet.

The incident serves as a stark reminder of the "invisible" infrastructure that powers the modern enterprise. As companies continue to automate more of their operations, the risk of "data leakage by design" increases. Without a concerted effort to adopt secure testing practices and utilize reserved domains like .invalid, sensitive corporate and personal information will continue to drift into the hands of those who own the digital infrastructure—regardless of whether they are acting as "good guardians" or malicious opportunists. The challenge remains to bridge the gap between technical possibility and operational reality, ensuring that the convenience of automated messaging does not come at the cost of fundamental data security.