A researcher bought noreply.net. Companies started sending him secrets.
Companies treat some email domains as digital trash cans, despite the risks.
Cory Solowe...'s inbox is an accidental evidence locker. Since December 2024, the researcher's catch-all domains have collected more than 400,000 messages, a number that sounds like spam statistics until you look at what is inside: injury reports from a city government, pizza order confirmations, school account setup emails, service orders, and test platform credentials.
The mechanics are almost embarrassingly simple. An email address is a routing instruction. When a developer types 'noreply' into a configuration field and leaves it there, or when an organization uses 'noreply' as if it were a harmless label rather than a real destination, the mail system does exactly what it was told. There is no firewall that recognizes 'noreply' as a placeholder. There is only the mail exchanger at the other end, and in this case the mail exchanger belongs to a stranger who decided to listen.
What makes this a story about security is not the absence of malice. It is the presence of trust. The same companies that would never ship a customer database to a random address are, in effect, shipping the contents of their operational inboxes to a domain they never bothered to check or own. The word 'noreply' never promised confidentiality. It only promised silence.
There is a quiet lesson for every organization that runs automated notifications: an address that does not want replies is still an address. If the domain is not yours, every message sent to it is a letter delivered to the wrong building. And if the message contains credentials, health details, or a child's school account, the mistake is not a nuisance. It is a disclosure.
The solution has none of the glamour of a security conference. Audit every outbound mail configuration. Remove placeholder domains from production code. Treat automated email as the sensitive pipeline it already is. Until then, there will always be an enterprising researcher buying the names that companies assume no one would ever think to own.