Two security researchers purchased commonly-used generic email domains and discovered hundreds of companies automatically sending sensitive corporate data to their listening services. The experiment reveals a widespread failure in email configuration practices across organizations.
Security researchers acquired domains including noreply.net and deleteduser.com, then monitored incoming mail to document what companies inadvertently send to these generic addresses.
The researchers found that many organizations default to sending automated messages from generic "no reply" addresses without verifying domain ownership first. This basic oversight creates a security gap where legitimate-sounding email addresses actually route to unintended recipients.
What's Being Sent
Incoming messages included corporate secrets, customer data, password reset links, and internal communications. The volume and sensitivity of information demonstrates how many companies treat these generic addresses as safe defaults without considering the risks.
Why This Happens
Automated systems—from password recovery to order confirmations—often use templated "no reply" addresses. Without proper domain validation or ownership verification, these systems assume standard naming conventions are safe. Developers frequently hardcode these addresses into applications without testing whether they actually own the domain.
The Broader Issue
This vulnerability stems from inconsistent email infrastructure practices and insufficient security reviews during development. Many organizations lack procedures to verify that domains used in automated systems are actually under their control.
The researchers' approach parallels previous security studies using common typos or generic terms to intercept misdirected traffic. It highlights how basic configuration errors at scale create exploitable patterns.
Implications
Companies relying on generic email addresses should audit their systems immediately. IT teams need to verify domain ownership for all automated communication endpoints and implement proper validation before deployment.
The incident underscores the importance of security reviews covering not just code, but infrastructure assumptions. Standard practices like checking domain registration and validating DNS records are essential steps often overlooked in development cycles.
Security researchers have identified potential hardware backdoors in certain x86 processors. The findings, detailed in a GitHub repository called Rosenbridge, reveal vulnerabilities at the processor level that could allow unauthorized access.
Flock Safety, the traffic camera company, is expanding beyond law enforcement with plans to deploy dashcams in rideshare vehicles and offer coaching services to police departments.
A sharp rise in explicit deepfake images of UK children has been reported by an online safety service, as authorities warn that AI tools are making the creation of sexualized or 'nudified' content increasingly accessible.
Gen's latest threat report details two distinct attack campaigns exploiting compromised email accounts and clipboard manipulation to steal from businesses and cryptocurrency users.