Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All

Imagine receiving over 400,000 unwanted emails in just 18 months, containing sensitive information about individuals and companies alike. This is the reality for Cory Solovewicz, a security researcher who has inadvertently created a massive honeypot for misconfigured email systems. Solovewicz's domain, noreply.us, has received an astonishing 401,796 messages since December 2024, averaging a staggering 699.99 emails per day. But what's even more astonishing is the nature of these emails – they contain confidential information, such as injury reports, pizza orders, and even account setup emails from a school platform.

Background & Context

Cory Solovewicz, a seasoned security researcher, purchased the domain noreply.us in 2020, initially planning to use it as a catch-all email to filter messages and enhance his privacy. However, he soon discovered that other systems were sending mail to @noreply.us addresses, creating an accidental honeypot that has since become a massive undertaking to warn businesses and organizations about their misconfigured internal systems.

It appears that companies and organizations have been inadvertently sending sensitive information to Solovewicz's domain, often using variations of the noreply.net format, believing they wouldn't be monitored. This phenomenon is not limited to Solovewicz's domain alone; many individuals may be affected, and it's a stark reminder of the importance of email security and configuration.

Key Details

Solovewicz's noreply.net domain has received an impressive 400,000 messages in just 18 months, with 28,365 of those containing attachments. The noreply.us domain, on the other hand, has seen 37,255 messages over the same period. The sheer volume of emails is a testament to the widespread issue of misconfigured email systems.

When asked about the nature of the emails he receives, Solovewicz reveals, "I get service orders for people that need repairs. I get lots of test platform credentials." This highlights the sensitive information that companies and organizations are inadvertently sharing with Solovewicz's domain.

Solovewicz's work is not just about exposing the issue; he's actively working to help affected companies and organizations fix their misconfigurations. "I just want companies and organizations to do the right thing and to be auditing their systems and fixing their stuff," he emphasizes.

What Experts Say

While Solovewicz's work is a stark reminder of the importance of email security, it also highlights the need for better configuration and security practices. "This is a classic example of how a well-intentioned configuration can lead to unintended consequences," says a security expert. "It's a wake-up call for companies and organizations to review their email security protocols and ensure they're not inadvertently sharing sensitive information."

Key Takeaways

• The noreply.us domain has received an astonishing 401,796 messages since December 2024, averaging 699.99 emails per day.
• The noreply.net domain has seen 400,000 messages in just 18 months, with 28,365 containing attachments.
• Solovewicz's work highlights the widespread issue of misconfigured email systems and the need for better security practices.
• Companies and organizations must review their email security protocols to ensure they're not inadvertently sharing sensitive information.

What This Means For You

While Solovewicz's work may seem like an isolated incident, it's a stark reminder of the importance of email security and configuration. As an individual, you may not be directly affected, but it's essential to understand the potential risks associated with misconfigured email systems. Companies and organizations must take responsibility for securing their email systems to prevent sensitive information from being shared inadvertently.

Solovewicz's work is a call to action for companies and organizations to review their email security protocols and ensure they're not inadvertently sharing sensitive information. As consumers, we must be aware of the potential risks associated with email security and demand better from the companies we interact with.