Researchers Intercept Corporate Secrets Sent to 'No Reply' Email Addresses
Two security researchers have demonstrated a significant and overlooked attack vector: companies sending sensitive information to email addresses that are never monitored because they appear to be automated or disposable.
The researchers purchased domains including noreply.net and deleteduser.com, then configured mail servers to capture any messages sent to these addresses. Their findings were striking—hundreds of organizations, including major corporations, were inadvertently routing a surprising volume of sensitive data to these unmonitored inboxes.
The leaked information included corporate secrets, password reset links, API authentication credentials, internal memos, and employee PII. In one notable case, a financial institution was sending wire transfer confirmations to a no-reply address.
The root issue stems from a common misunderstanding: many systems treat 'no reply' email addresses as dead ends, when in reality these addresses can be registered by anyone. When companies configure automated emails to send to addresses like [email protected], but that domain's no-reply address was never claimed, the messages bounce or get routed elsewhere—potentially to whoever controls that domain now.
This research highlights the need for organizations to audit their email-sending infrastructure and ensure that all reply-to and from addresses are either properly monitored or actively blocked from accepting mail.