Researchers Bought noreply.net and deleteduser.com. Companies Email Them Corporate Secrets
Two security researchers bought cheap domains, including noreply.net and deleteduser.com, and pointed them at email listening services. Hundreds of companies are still firing corporate secrets into those inboxes. The exposure is a configuration problem your team can audit today.
Two security researchers spent pocket change on a pair of ordinary-looking domains — noreply.net and deleteduser.com — wired them up to catch inbound mail, and sat back. What arrived was a steady drip of other companies' internal business: employee records, meeting invitations, travel bookings, and automated account notices, all addressed to mailboxes those companies assumed no human would ever read.
The mechanism is not an intrusion. It is a configuration habit. When an application sends a notification “from” a no-reply address — or a system stubs out a departed employee as a “deleted user” — it sometimes points that address at a real, registerable external domain instead of one the organization controls. Register the domain, stand up a catch-all, and the misdirected mail lands in a stranger's inbox. Hundreds of companies are sending corporate secrets to two domains — noreply.net and deleteduser.com — that are now owned by outside researchers, not by the companies themselves.
What the Researchers Actually Did
The experiment was first detailed by WIRED. Two researchers, identified in that reporting as Cory Solovevich and Mike Sheward, independently bought cheap domains and stood up what WIRED calls “email listening services” — catch-all mailboxes that accept any address at the domain. Solovevich operates noreply.net; Sheward, per the report, spent roughly $15 on deleteduser.com and saw mail from three separate organizations arrive within the first hour.
The volume is the part that should give security teams pause. According to WIRED's reporting, one of these domains has logged more than 400,000 messages since December 2024 — on the order of 700 a day — including tens of thousands of file attachments. The specific data classes WIRED describes are mundane on their face and sensitive in aggregate: employee names, internal vacation and time-off requests, hotel and travel bookings, and Zoom meeting invitations. None of it was meant to leave the sending company. All of it did.
To be precise about what is and is not confirmed: the researchers' identities and the categories of leaked data above come from WIRED's account and independent write-ups of it, not from direct observation by this newsroom. The specific companies affected have not been named publicly. WIRED reports the researchers have been notifying affected organizations rather than exploiting what they receive, and that Solovevich has bought more than 30 related domains defensively to keep them out of malicious hands. Whether any of these domains will ultimately be transferred to a coordinating body is not stated.
Why a “No-Reply” Address Becomes a Leak
Two design shortcuts collide here. The first is treating “no-reply” as a destination rather than a convention. The intent of a no-reply address is that inbound replies get ignored — but that only holds if the domain behind the address stays under your control. If an automated system is configured to send as noreply@noreply.net, the “no-reply” part is doing nothing; the mail is addressed to a domain anyone can buy. The RFC-reserved convention is to keep the meaning in the local part — noreply@yourcompany.com — on a domain you own and monitor.
The second shortcut is placeholder addresses for accounts that no longer exist. When a directory or SaaS tool represents a removed user as a “deleted user” and pushes notifications to an address like deleteduser@deleteduser.com, it assumes the far end is a dead drop. Register the domain and it becomes a live one. Typos, retired brand domains, and lapsed registrations produce the same failure: mail that was supposed to vanish instead gets delivered to whoever holds the name.
This is a cousin of the exposure problems we have covered elsewhere — internet-facing assets that quietly sit open until someone notices, like the 4,400 exposed Rockwell PLCs mapped earlier this month. The common thread is not a clever attacker; it is a default configuration nobody re-checked.
What Defenders Should Do This Week
None of the fixes here require new tooling. Start by pulling a list of every service — CRM, ticketing, HR platform, custom app — that generates outbound email, and check the exact sending address each one uses. The addresses to worry about are the ones whose domain is not on your own registrar account. If you find an automated flow sending as an external .net or lookalike domain, that flow is a candidate leak.
From there, move sending to an owned domain and reserve the intent in the local part, so noreply@ and deleteduser@ resolve to a mailbox you monitor or intentionally black-hole. Add the obvious no-reply variants to your domain's registration and DNS so no one else can claim them. For departed-employee handling, confirm your directory does not route notifications to a placeholder domain you never registered. This is close in spirit to the credential-hygiene lessons from the Snowflake breach wave: the damage came less from a novel exploit than from access paths no one had locked down.
My read: This is not a vulnerability anyone needs to patch — it is a hygiene gap that has probably existed at your organization for years, silently. The uncomfortable detail is passivity. The researchers did not phish anyone or break authentication; they bought a domain and waited, and corporate mail came to them. That means the only reliable control is on the sending side. Treat “which external domains do our systems email as if they were dead ends?” as a standing question, not a one-time audit. And assume that if a placeholder domain is cheap and available, someone with worse intentions than these two researchers has already considered buying it.
The framing that matters for a security team is ownership: a no-reply address is only safe when the domain behind it is yours. Everything else is a bet that no one will ever register the name.
