A researcher bought noreply.net. Companies started sending him secrets.
Summary
A security researcher named Cory Solovewicz bought the email domains noreply.us and noreply.net and started receiving hundreds of thousands of emails meant for other people or companies. These emails often contain private information and company secrets because many organizations mistakenly send messages to these "noreply" addresses. Solovewicz alerts companies about these mistakes to help them fix their email systems.Key Facts
- Cory Solovewicz owns the domains noreply.us (since 2020) and noreply.net (since 2024).
- Since December 2024, noreply.net has received about 401,796 emails, averaging 700 emails per day.
- Many emails contain sensitive data like injury reports, repair orders, and account information from various organizations.
- Companies often send emails to these noreply addresses thinking the messages go nowhere or are unmonitored.
- Solovewicz calls this situation an accidental "honeypot," where he unintentionally collects large amounts of misdirected data.
- The emails come from over 14,000 different email addresses and 6,200 root domains.
- Solovewicz warns affected organizations to audit and fix their email systems to stop leaking information.
- Other security experts have noticed similar problems with unused or placeholder email addresses causing data leaks.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
