Security Researchers Expose Massive Data Leaks via Abandoned Placeholder Domains

Security researchers have uncovered a systemic vulnerability where thousands of organizations leak sensitive data to third parties by sending emails to common placeholder domains. By purchasing domains like noreply.net and deleteduser.com, researchers found that automated systems continue to route private information to these addresses under the mistaken assumption that they are unmonitored or non-existent.

According to reports from for(geeks) and Wired, researcher Cory Solovewicz received approximately 400,000 messages over 1.5 years via the noreply.net domain, including 28,365 emails with attachments. These communications originated from more than 14,000 unique 'from' addresses spanning 6,200 root domains. Similarly, researcher Mike Sheward received thousands of emails from at least 100 different organizations after purchasing deleteduser.com for roughly $15. To gauge the scale of the issue, a scan of 7,136 potential placeholder domains revealed that 328 were already configured with catch-all inboxes, which capture every email sent to any address at that domain.

The Mechanics of the Leak

This vulnerability stems from poor account-lifecycle management within corporate automated systems. Many organizations use 'noreply' or 'deleteduser' as placeholders when a user leaves a company or deletes an account. Instead of removing the record entirely, some systems simply transform the email address into a placeholder, such as user@deleteduser.com. When a third party purchases these common domains and enables a catch-all email service, they effectively create a vacuum that sucks in every message intended for those defunct accounts.

Industry Implications

This discovery proves that 'no-reply' addresses are not effective security controls and that relying on them can lead to the exposure of personally identifiable information (PII), medical records, and internal corporate secrets. The ease with which this data can be harvested—sometimes for as little as $15—creates a significant opportunity for malicious actors to gather intelligence or harvest credentials. "I created an accidental honeypot," Solovewicz stated, noting that he had no idea the volume of data would be so extensive.

Next Steps for Organizations

The researchers are urging companies to overhaul their system configurations to prevent the automatic routing of data to domains they do not control. Solovewicz emphasized the urgency of the situation, stating, "You guys need to fix your systems and not do this and not leak your customer data and your employee data and your own internal data." Organizations must now audit their automated mailing lists and account deletion workflows to ensure that placeholder domains are not being used as a substitute for proper data erasure.