Security researcher Cory Solowevicz didn't set out to build a honeypot. He just wanted a catch-all email to filter spam. But after buying the domains noreply.us in 2020 and noreply.net in 2024, he started receiving thousands of misdirected emails meant for other people. Since December 2024, one of those domains has pulled in 401,796 emails—an average of roughly 700 per day. The contents: injury reports from a city government, pizza order confirmations, school account setup messages, service orders, and test platform credentials. Private information and company secrets, all landing in one inbox. Solowevicz calls it an 'accidental honeypot.'
How a catch-all became a leak
The idea was simple. Solowevicz set up a catch-all address on noreply.us to collect any email sent to that domain, hoping to filter out junk and keep his own inbox clean. Then he added noreply.net in 2024. What he didn't expect was that thousands of people and systems would type 'noreply@' addresses into forms, auto-fill fields, or just guess wrong. Instead of bouncing, those emails came to him.
đź“Š Market Data Snapshot
The volume is staggering. Nearly half a million emails in under two years. That's not a trickle; it's a flood. And it's not just spam—it's real correspondence that was never meant to reach him.
What's sitting in the inbox
The exposed data reads like a cross-section of digital life. Injury reports from a city government suggest internal workplace documents. Pizza orders might seem trivial, but they tie names to addresses and phone numbers. School platform setup emails can reveal student accounts and possibly credentials. Service orders and test platform logins are the kind of thing a security researcher would flag immediately.
Solowevicz didn't go looking for this data. It came to him. That's the point. Anyone who controls a domain like noreply.com or noreply.org could end up in the same position—accidentally hoarding sensitive information.
Why crypto should care
This isn't a crypto story on its face. But it touches a raw nerve for the industry. Crypto exchanges, wallets, and DeFi platforms rely on email for authentication, password resets, and notifications. A misdirected password reset link or a verification code sent to the wrong inbox is a security hole. An attacker who buys a similar domain—say, 'noreply-security.com'—could intercept emails meant for users of a specific service.
The incident is a real-world proof point for the argument that email is fragile. Decentralized identity systems—like ENS or Handshake—and encrypted messaging aren't just nice-to-haves. They're infrastructure that could replace the weakest link in the chain.
For now, the market hasn't moved. No price catalyst, no panic. But the story feeds a longer-term narrative: centralized email is a liability. Privacy-focused assets like XMR or ZEC could see speculative interest if this goes viral, though any effect would likely be muted and delayed.
Solowevicz hasn't said what he plans to do with the data. He didn't ask for it. But the inbox keeps filling. The next person who buys a similar domain might not be a researcher—and that's the uncomfortable question this accidental honeypot leaves behind.
