Security Researcher's Accidental Honeypot Domains Capture 401,796 Private Messages

Cory Solovewicz, a security researcher and consultant, purchased the domains in 2020 and 2024, respectively, initially planning to use noreply.us as a catch-all email for privacy. Instead, he created what he calls an "accidental honeypot, as organizations worldwide have been inadvertently sending messages meant for other people to addresses on those domains. Since December 2024, one of his domains has registered 401,796 messages—an average of 699.99 per day.

The influx includes injury reports from a city government, confirmation of people's pizza orders, account setup emails from a school platform, service orders for repairs, and test platform credentials. "I get service orders for people that need repairs. I get lots of test platform credentials, Solovewicz said. I had no idea it was going to turn into this.