According to Wired, infosec researcher Kory Soloveychik, the owner of the noreply.net and noreply.us domains, has received more than 401,000 misdirected emails since December 2024 — ranging from injury reports to test system credentials. Companies are widely using addresses on such domains as placeholders, unaware that the email is actually being delivered. The problem affects organizations across a wide range of sectors: from education and food service to government agencies and industrial enterprises. To protect themselves, it is sufficient to switch to internal domains or to the reserved top-level domain .invalid.
Timeline and scale of the problem
As reported, Soloveychik purchased the noreply.us domain in 2020 for his personal email filtering, and noreply.net in 2024. Both domains were configured as catch-all — meaning they accepted email sent to any address within the domain. The researcher quickly discovered that they were receiving a stream of automated notifications from third-party services.
On noreply.net alone, during the period since December 2024, 401,796 incoming emails have been recorded — on average around 700 messages per day. Of these, 28,365 contained attachments. In the last month before Soloveychik’s talk at the DEF CON conference, both domains received more than 11,000 emails sent from over 14,000 addresses belonging to 6,200 domains.
According to the researcher, the intercepted correspondence included:
- reports from municipal services about workplace injuries;
- pizza order confirmations;
- notifications about account creation on educational platforms;
- maintenance requests;
- credentials for test systems.
Root causes: why emails go to someone else’s domains
The root of the problem lies in using actually routable domains as placeholders. There appear to be two main scenarios:
Deliberate placeholders. Organizations insert addresses like [email protected] into sender or recipient fields, based on the mistaken assumption that such a mailbox does not exist. In reality, the noreply.net domain is registered and receives email.
Replacement for deleted accounts. When an employee leaves or a user is deactivated, some systems automatically replace their email address with a placeholder instead of fully deleting the account. If the placeholder points to a public domain, emails are sent to that domain’s owner.
Not an isolated case: deleteduser.com and donotreply.com
The problem is reproducible with other “speaking” domains. Mike Sheward, head of security at Xeal, according to his own account, bought the deleteduser.com domain in early 2025 for about $15 and within the first hour received emails from three organizations. Since then, thousands of messages from at least 100 companies have arrived, including data on medication orders, vacation approval requests, hotel bookings with guests’ full names, and Zoom invitations from a UK government agency.
One particular case involves an unnamed company operating in the AI field: according to social media posts, its safety compliance analytics systems for industrial sites in the Middle East sent Sheward thousands of frames from surveillance cameras. This information is based on the researcher’s own publication and has not been confirmed by an official statement from the company.
The problem has existed for many years. As far back as about 20 years ago, journalist Brian Krebs described a similar situation with the donotreply.com domain, to which companies were sending millions of emails.
Impact assessment
The scale of potential exposure is significant. Soloveychik checked 7,136 potential placeholder domains and found that 328 of them were configured as catch-all and capable of accepting any incoming email. This means that hundreds of domains right now can accumulate sensitive data — and not all of them are owned by well-intentioned researchers.
Risks for organizations include:
- Personal data leakage — names, addresses, order details, medical information;
- Account credential compromise — logins and passwords for test (and potentially production) systems;
- Leakage of internal communications — HR requests, bookings, meeting invitations;
- Violation of regulatory requirements — GDPR, Russian Federal Law 152-FZ, and other personal data protection regulations.
Realizing the scale of the threat, Soloveychik and Sheward independently purchased more than 30 similar domains to prevent them from falling into the hands of malicious actors. However, this is a private initiative that does not solve the systemic problem.
Practical recommendations
To prevent unintentional data from being sent to third-party domains:
- Audit placeholder addresses. Check all system configurations that use addresses with patterns like “noreply”, “donotreply”, “deleteduser”, and similar. Make sure the domains in these addresses belong to your organization.
- Use internal domains. For placeholders, use your organization’s own domains (for example,
[email protected], where example.com is your domain) or subdomains that are not routed to the external network. - Use the reserved .invalid domain. According to RFC 2606, the
.invalidtop-level domain is guaranteed not to resolve in DNS and cannot receive email. An address like[email protected]is safe to use as a placeholder. - Review your user deactivation procedure. When deleting employee accounts, do not replace their email with a placeholder using an external domain. Completely remove the linkage or redirect it to an internal address.
- Configure outbound email monitoring. Implement DLP rules that block sending emails to domains matching common placeholder patterns.
The twenty-year history of this problem — from donotreply.com to noreply.net and deleteduser.com — shows that it will not disappear on its own. Every organization that uses email placeholders should immediately check whether it is sending sensitive data to domains it does not own, and switch to using its own domains or the reserved .invalid TLD for all placeholder addresses.
