A cybersecurity researcher who purchased the domain noreply.net out of curiosity has inadvertently become the unintended recipient of hundreds of thousands of sensitive corporate emails, exposing a widespread and decades-old failure in how companies manage automated communications and user account data. The researcher, known publicly as Solovewicz, has over the past year and a half received more than 400,000 messages sent to the noreply.net domain, with over 28,000 of those emails containing attachments. The problem, while not technically complex, reveals a systemic negligence in enterprise data management that has persisted for nearly two decades.<\/p>\n
Soloweicz, who has not publicly named the affected organizations, purchased the noreply.net domain as an experimental project. The idea was simple: many companies configure their automated systems to send emails from addresses like noreply@company.com, but when email systems are misconfigured, or when employees and automated processes mistakenly use a domain they do not control\u2014such as noreply.net\u2014the messages go to whoever owns that domain. In this case, they went to Soloweicz. The researcher owns multiple such domains, including noreply.us, which has received over 37,000 messages since its purchase in 2020. In the month leading up to a recent conference presentation, the two domains combined received more than 11,000 emails.<\/p>\n
The researcher describes the influx as entirely automated. “These are not human-written emails,” Soloweicz explains. “They are generated by company systems.” The volume of data is staggering: the messages originate from over 14,000 distinct “from” addresses, spanning more than 6,200 unique root domains. This means that thousands of different companies, ranging from small businesses to large enterprises, have been unwittingly funneling internal communications\u2014including potentially sensitive attachments\u2014to a domain they do not own.<\/p>\n
The issue of companies misdirecting emails to unowned domains is far from novel. Almost twenty years ago, independent security journalist Brian Krebs, then writing for the Washington Post, documented how businesses were sending millions of messages to the @donotreply.com domain. That domain, like noreply.net, was a generic-sounding address that any company could inadvertently use if their systems defaulted to it. The core problem is that many organizations treat email addresses like noreply@company.com as convenient placeholders for automated responses, error notifications, and system-generated messages, but they fail to verify that the domain part of the address is actually under their control.<\/p>\n
The solution, security experts have long pointed out, is straightforward. Companies can use internal domains that are not routable on the public internet, or they can employ the .invalid top-level domain, which is reserved by internet standards (RFC 6761) for use in documentation and testing, and is guaranteed not to resolve to any real email server. The fact that organizations continue to send sensitive data to third-party owned domains is, Soloweicz argues, entirely avoidable. “I just want companies and organizations to do the right thing and to be auditing their systems and fixing their stuff,” he says.<\/p>\n
To understand how a domain like noreply.net becomes a firehose of corporate secrets, it helps to examine the common configuration errors. Many enterprise applications\u2014customer relationship management (CRM) systems, human resources platforms, helpdesk software, marketing automation tools, and even cloud infrastructure services\u2014allow administrators to set a default “from” address for system-generated emails. In many cases, the default value is something like noreply@company.com. However, if an administrator types the domain incorrectly, or if the system is configured to use a generic domain like noreply.net as a placeholder that is never updated, every email sent by that system will be delivered to the owner of that external domain.<\/p>\n
A second, more insidious source of the problem is account deletion. When a user leaves an organization, their email account is often deleted or suspended. However, the automated systems that previously sent emails to that user’s address\u2014such as newsletter subscriptions, notification alerts, or calendar invitations\u2014are rarely updated to remove the old address. If a company reuses email addresses, or if the domain for the deleted account eventually expires and is purchased by a third party, those automated messages begin flowing to the new domain owner. This is exactly what happened on a massive scale with noreply.net and noreply.us.<\/p>\n
The emails are not limited to benign notifications. Soloweicz reports that a significant portion of the 28,365 messages containing attachments have included sensitive documents such as invoices, customer lists, internal reports, and even password-protected files. While the contents of those attachments have not been publicly disclosed by the researcher, the volume and variety of data point to a systemic leakage of proprietary information.<\/p>\n
Soloweicz is not the only researcher to discover this vulnerability. Earlier this year, Mike Sheward, head of security at EV charging company Xeal, spent approximately $15 to purchase the domain deleteduser.com. The name itself hints at the intended use case: it is a domain that appears plausible as an email address for a former employee. Within the first hour of owning the domain, Sheward received emails from three different organizations. “Companies appear to be simply changing email addresses rather than entirely deleting accounts from their systems,” Sheward told a journalist.<\/p>\n
Sheward\u2019s experience mirrors Soloweicz\u2019s on a smaller scale but with equally revealing results. He has received emails from at least 100 different organizations across the multiple domains he now controls. The content of these emails is a window into corporate disorganization: details of people\u2019s Viagra orders, requests to approve vacation time or leave of absence, hotel bookings containing full names and credit card information, and invitations to Zoom meetings from a UK government agency. “There\u2019s a lot of cybersecurity companies and a few Microsoft<\/a> partner companies as well,” Sheward noted. One particularly telling example was an invitation to a San Francisco<\/a> company\u2019s summer barbecue, addressed with the line “Dear Deleted User.” The message, intended for a former employee, was sent without any verification that the email address still belonged to the intended recipient.<\/p>\n The persistence of this issue, spanning two decades, points to deeper organizational failures rather than mere technical oversights. One major factor is the lack of centralized control over email system configurations. In many organizations, different departments\u2014marketing, HR, IT, customer support\u2014manage their own software platforms independently. Each of these platforms may have its own email configuration settings, and there is often no oversight to ensure that every system is using a legitimate, company-owned domain for its automated messages.<\/p>\n Another significant factor is the lifecycle management of user accounts. When an employee leaves a company, the IT department typically disables their email account, but the list of automated subscriptions and notification preferences tied to that address is rarely cleaned up. The systems that send those emails are not designed to check whether the recipient address is still valid or still belongs to the organization. This creates a “digital ghost” problem, where emails continue to be sent to a domain that may have been released back to the public or purchased by a third party.<\/p>\n Finally, there is a cultural and educational gap. Many developers and system administrators are not aware that using an external domain for internal system emails is a security risk. The convenience of typing “noreply@company.com” is so ingrained that the possibility of the domain being registered by someone else is not considered. The .invalid domain exists specifically to prevent this kind of error, but it is rarely used outside of technical documentation.<\/p>\n The .invalid top-level domain is a special-use domain name reserved by the Internet Engineering Task Force (IETF) in RFC 6761. It is explicitly designated for use in documentation, testing, and examples. Because it is not intended to be registered in the Domain Name System (DNS), any email sent to an address ending in .invalid will simply bounce\u2014it cannot be delivered to any real server. This makes it a safe choice for companies that need to use a dummy or placeholder email address in their systems. Despite its availability for nearly a decade, adoption remains extremely low among enterprise software vendors.<\/p>\n The combined data from Soloweicz and Sheward provides a rare glimpse into the sheer volume of misdirected corporate email. Soloweicz\u2019s noreply.net domain has accumulated 400,000 messages over 18 months, averaging over 22,000 emails per month. The noreply.us domain has received approximately 37,255 messages over 2,345 days\u2014an average of about 16 emails per day, though the rate has clearly accelerated in recent months. Combined, the two domains received more than 11,000 messages in the month before Soloweicz\u2019s conference talk alone.<\/p>\n Sheward\u2019s domains, while less prolific, still demonstrate that this is not an isolated phenomenon. At least 100 different organizations have sent emails to his deleteduser.com domain, spanning industries from healthcare to cybersecurity to government. The fact that these are not isolated incidents but rather a consistent pattern across multiple owned domains suggests that the problem is endemic in the corporate world.<\/p>\n To put the numbers in context: if just 0.1% of the emails sent to Soloweicz\u2019s domains contained sensitive customer data, that would represent roughly 400 data leak incidents from a single domain owner. When multiplied across thousands of similar domains that may be registered by other researchers or malicious actors, the potential for data exposure becomes enormous.<\/p>\n Both Soloweicz and Sheward have taken a responsible approach to the data they have collected. Rather than publishing the contents of the emails or publicly naming the companies involved, they have been quietly alerting affected organizations about their misconfigurations. Soloweicz encourages companies to audit their systems and fix the underlying errors. “I did not realize that this was going to be as big of a problem as it is,” he admitted. “I just want companies and organizations to do the right thing.”<\/p>\nWhy Companies Keep Misdirecting Emails: The Root Causes<\/h2>\n
What Is the .invalid Domain and How Does It Prevent Data Leaks?<\/h2>\n
The Scale of the Problem: Numbers That Demand Attention<\/h2>\n
The Ethical Dilemma for Researchers: Alerting Companies to Their Own Mistakes<\/h2>\n