Man Who Bought noreply.net Got 400,000 Confidential Emails 2026

A security consultant who purchased the domain noreply.net has received more than 400,000 misdirected emails containing confidential business data, highlighting a widespread email security failure. Cory Solovewicz, a security consultant and developer, bought the domain in 2020 and set up a catch-all mailbox to capture every message sent to any address at that domain.

What started as a personal experiment quickly turned into an accidental honeypot. According to a presentation at DEF CON 34 reported by Wired, Solovewicz's mailboxes on noreply.us and noreply.net have collected over 400,000 messages since 2024 alone. Many of these emails contain sensitive files, personal information, and internal company communications that were never meant to leave the organization.

Why Did Someone Buy noreply.net?

Solovewicz is an avid domain collector who often starts projects that later go dormant. He first bought noreply.us and, four years later, reserved noreply.net. His goal was simple: create a personal email address that would capture all mail sent to the domain. He didn't expect the flood of messages that followed.

The noreply.net domain is commonly used by companies as a fake sender address for automated notifications. When employees reply to those emails or systems misconfigure the reply-to field, messages bounce to the actual domain owner—in this case, Solovewicz. He configured his server to accept all incoming mail, turning it into a massive repository of misdirected correspondence.

What Kind of Data Was Exposed?

The emails contained a wide range of confidential information. Solovewicz found files with personal data, financial records, and internal documents that companies accidentally sent to the noreply address. Because the domain was set up to receive all messages, nothing was rejected or returned to sender.

This isn't just spam. The misdirected emails included attachments with sensitive business information, making the noreply.net inbox a treasure trove for anyone with malicious intent. Solovewicz, however, used the data to study the problem and raise awareness, not to exploit it.

Examples of Exposed Information

While specific details are limited, the presentation highlighted that the emails contained confidential files and private information that companies shared with the noreply domain by mistake. This includes anything from HR documents to customer data, depending on what automated systems sent.

How Big Is the Problem?

The scale is staggering: over 400,000 messages since 2024. That's an average of more than 1,000 misdirected emails per day. The volume suggests that many organizations have misconfigured systems or employees who reply to automated notifications without checking the recipient address. Context on how this played out before sits in Man Who Bought noreply.net Got 400,000 Confidential Emails.

The problem is compounded by the fact that noreply.net is just one of many similar domains. Solovewicz also owns noreply.us, and there are countless other variations like noreply.com that could be similarly abused. The potential for data leakage is enormous. The background to this story is set out in NSW Liberal Leak Inquiry: Tudehope Admits Sending Confidential. A related thread runs through Technology: latest articles.

What Are the Key Takeaways for Businesses?

• Audit your email configurations: Ensure that automated emails use a valid reply-to address or a domain you control.
• Educate employees: Train staff never to reply to noreply addresses and to verify recipients before sending sensitive information.
• Monitor for misdirected emails: Set up filters to catch emails sent to external domains that resemble noreply addresses.
• Use DMARC and SPF: Implement email authentication to prevent spoofing and improve deliverability.
• Consider owning your noreply domain: If you use a noreply address, register the domain to prevent others from receiving misdirected mail.

What Should You Watch Next?

Solovewicz's DEF CON 34 talk (available as a PDF) provides a detailed account of his findings. He hopes to raise awareness about the risks of misdirected emails and encourage companies to secure their email practices. As more businesses rely on automated notifications, the potential for similar leaks grows. Earlier coverage in Jabaroot: The Mystery Hacker Behind Morocco's Biggest Data Leaks shows how the argument developed. A closer look at the same subject appears in Why Millions of Working Hard Drives Are Destroyed Annually.

The incident also raises questions about data privacy regulations. Companies that accidentally send personal data to an unrelated third party could face legal consequences under laws like GDPR. Solovewicz's experiment serves as a wake-up call for organizations to treat email security as a critical priority. Anyone following the wider picture can start with Passkeys Security Flaw: New Research Exposes Passwordless Risk. The same theme surfaces in DHS Data Leak Exposes 41,000 Homeland Security Workers, which takes a different angle.

FAQ

Comparison of Email Security Measures

The noreply.net case is a reminder that even small oversights in email configuration can lead to significant data leaks. By taking proactive steps, organizations can protect sensitive information and avoid becoming part of the next headline.