He Bought 'noreply.net.' Now Companies Accidentally Mail Him Their Secrets.

Cory Solovewicz bought noreply.net in 2024 to filter his own mail. He expected a quiet inbox. Instead, the address has since collected 401,796 messages, about 700 a day, that were never meant for him: a city government's injury report, a pizza order confirmation, a school platform's account-setup email, a home-appliance service ticket, a stack of test credentials.

None of it is spam. It is other people's data, sent by senders who assumed nobody was listening.

A "honeypot," in security research, is a decoy address set up to attract misdirected traffic and expose a misconfiguration. Solovewicz did not set out to build one. The companies sending to his domain did, by treating "noreply" as a synonym for "nowhere."

Solovewicz presented the work at Defcon on August 10. The same day, WIRED and Ars Technica published accounts of what arrived in his inbox. His first calculation, by his own count, logged an average of 699.99 messages per day between December 2024 and this summer.

"I created an accidental honeypot," Solovewicz told WIRED. "I had no idea it was going to turn into this."

The misdirected mail falls into two buckets. Some comes from senders who use [company]@noreply.net as a return-path or "from" address on transactional email, and never check the bounce log. The rest comes from a second failure mode: when an employee leaves or a user account is deleted, the company rewrites the dead address into a placeholder noreply-style domain and keeps firing mail at it. Both modes treat the address as unowned, and both are wrong.

The volume and the categories are the story. The city government injury report carried identifying information about a person who was not Solovewicz. The pizza order confirmation carried a name, an address, and a delivery time. The school platform's account-setup email was a working credential for a parent's dashboard. The service-repair ticket was a stranger's appliance, address, and phone number. The test credentials opened access to a third-party platform's sandbox.

Solovewicz is not running an exploit. He has shifted from logging the inbox to back-channel notifications to the affected senders, warning them that the assumption embedded in their mail flow is wrong. He has also said he is relieved to hold the domains rather than a criminal operation or a state-aligned group, which would have used the same misdirection for quiet collection. The counterfactual is the stakes: the configuration that filled his inbox would have worked the same way for an attacker.

The pattern is not new. In 2022, security researcher Mike Sheward documented a near-identical accidental honeypot at deleteduser.com, a placeholder domain that swallowed the same class of misdirected personal information attached to deleted or dormant accounts. "Deleteduser.com — a $15 PII Magnet" ran on the same logic: a cheap domain, a sender assumption that nobody was reading the inbox, and a steady stream of real data.

Two independent researchers, two cheap domains, two years apart, the same shape of failure. That is what turns Solovewicz's inbox from a curiosity into a category.

The audit question for any IT or security team is short: pull the bounce log for every noreply-style address on your outbound mail flow, and check whether the domain is actually yours, parked, expired, or owned by a third party. The second a noreply address points at a domain you do not control, the same honeypot is already being built. The remedy is a one-line configuration change and a policy decision that placeholder addresses are owned, not abandoned.

Solovewicz says the next phase of the work is a wider notification sweep, starting with the largest senders in the inbox. Email routing has long assumed that an address is a destination, not a trap. It can be both.