--- title: A researcher bought noreply.net. Companies started... description: Security researcher Cory Solovewicz purchased the domains noreply.us and noreply.net, inadvertently creating a honeypot that receives nearly 700 emails per day... canonical: https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A researcher bought noreply.net. Companies started sending him secrets | daily.dev og:description: Security researcher Cory Solovewicz purchased the domains noreply.us and noreply.net, inadvertently creating a honeypot that receives nearly 700 emails per day... og:url: https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa og:image: https://api.daily.dev/og/posts/QlgQTArqa.png og:image:alt: A researcher bought noreply.net. Companies started sending him secrets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A researcher bought noreply.net. Companies started sending him secrets **[Lobsters](https://daily.dev/sources/lobsters)** · 2 min read · 0 upvotes · 0 comments ## Summary Security researcher Cory Solovewicz purchased the domains noreply.us and noreply.net, inadvertently creating a honeypot that receives nearly 700 emails per day containing sensitive data — including injury reports, test credentials, pizza orders, and account setup emails. Companies mistakenly send emails to these domains believing they go nowhere or are unmonitored. Solovewicz presented his findings at DEF CON, warning organizations about misconfigured systems leaking private information to domains they don't control. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens when a company sends email to a noreply domain they don't own? If a company sends email to a noreply-style domain (like noreply.net or noreply.us) that they don't control, those emails are delivered to whoever owns that domain. A researcher who purchased noreply.net and noreply.us received nearly 700 emails per day containing sensitive data including test credentials, injury reports, account setup emails, and service orders from real organizations. _Teams auditing their email infrastructure find relevant incidents and patterns on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 9 comments across lobsters (as of 2026-08-11). **TL;DR:** Commenters largely validate the story through personal anecdotes of receiving misdirected emails at their own addresses, treating the phenomenon as a well-known but underappreciated problem rather than debating the researcher's specific findings. **Sentiment:** 30% positive · 50% mixed · 20% skeptical **The case for** - Personal experiences shared by commenters confirm that misdirected email to unintended recipients is a widespread, real-world problem. - The issue extends beyond noreply domains — common name email addresses and generic accounts also accumulate sensitive misdirected mail (invoices, medical records, flight tickets). **The pushback** - The discussion doesn't critically engage with the researcher's findings or propose systemic fixes, staying mostly at the level of personal anecdote. **By community** - lobsters (mixed): Commenters mostly share their own misdirected-email war stories rather than analyzing the research itself, signaling broad recognition of the problem but little technical critique or praise. **Open questions** - What can individuals or organizations actually do to stop sensitive data from being sent to uncontrolled domains or mistyped addresses? - How should recipients of misdirected sensitive emails (medical records, job-start details) handle the ethical and legal implications? **Highlights** > Never forget the hire a hitman one that eventually led to the guy contacting the FBI > — [olliej on lobsters · 3 points](https://lobste.rs/s/exgfc0/researcher_bought_noreply_net_companies#c_veldk6) > reminds me of https://lobste.rs/s/muofgb/deleteduser_com_15_pii_magnet > — [fanf on lobsters · 6 points, 1 comments](https://lobste.rs/s/exgfc0/researcher_bought_noreply_net_companies#c_3ywvtu) > I've gotten invoices and medical records for someone with the same name as me, which is just incredible. > — [jeeger on lobsters · 1 points](https://lobste.rs/s/exgfc0/researcher_bought_noreply_net_companies#c_lgflt2) > I had "firstname@" on a mid size British residential ISP once and I have a common first name. The spam was insurmountable and the amount of genuinely misdirected email was incredible too. > — [0x2ba22e11 on lobsters · 2 points](https://lobste.rs/s/exgfc0/researcher_bought_noreply_net_companies#c_knv3tn) **Source threads** - [lobsters](https://lobste.rs/s/exgfc0/researcher_bought_noreply_net_companies) · 47 points · 9 comments ## Similar posts on daily.dev - [Deleteduser.com —a $15 PII Magnet](https://daily.dev/posts/deleteduser-com-a-15-pii-magnet-vsd5nzwa2) · Lobsters · 0 upvotes · 0 comments - [I accidentally made law enforcement shut down their fake honeypot](https://daily.dev/posts/i-accidentally-made-law-enforcement-shut-down-their-fake-honeypot-axaqdqznk) · Hacker News · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-tgc2xdvrr) · Schneier on Security · 0 upvotes · 0 comments - [My friend’s email startup finally got traction. Turns out it was a phisher.](https://daily.dev/posts/my-friend-s-email-startup-finally-got-traction-turns-out-it-was-a-phisher--t4kizq9px) · Medium · 0 upvotes · 0 comments - [Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a Critical Bug](https://daily.dev/posts/phone-numbers-and-emails-to-hidden-subdomains-the-osint-acquisition-pipeline-that-uncovered-a-criti-6eq4y2bm4) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A researcher bought noreply.net. Companies started sending him secrets","url":"https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa"},"datePublished":"2026-08-10T22:23:14.069Z","dateModified":"2026-08-11T09:53:50.825Z","description":"Security researcher Cory Solovewicz purchased the domains noreply.us and noreply.net, inadvertently creating a honeypot that receives nearly 700 emails per day...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ebb27ed847767d75df19620d87ee2ee2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ebb27ed847767d75df19620d87ee2ee2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"A researcher bought noreply.net. Companies started sending him secrets"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-researcher-bought-noreply-net-companies-started-sending-him-secrets-qlgqtarqa#faq","mainEntity":[{"@type":"Question","name":"What happens when a company sends email to a noreply domain they don't own?","acceptedAnswer":{"@type":"Answer","text":"If a company sends email to a noreply-style domain (like noreply.net or noreply.us) that they don't control, those emails are delivered to whoever owns that domain. A researcher who purchased noreply.net and noreply.us received nearly 700 emails per day containing sensitive data including test credentials, injury reports, account setup emails, and service orders from real organizations. Teams auditing their email infrastructure find relevant incidents and patterns on daily.dev."}}]} ```