A researcher bought noreply.net. Companies started sending him secrets.

A researcher purchased the email domain noreply.net and received confidential business communications, payment information, and other sensitive data sent to that address by multiple companies. The domain is commonly used by businesses as a no-reply email address for automated messages, but the researcher's acquisition of it meant he became the recipient of misdirected corporate correspondence. The incident highlights that some companies do not verify ownership of email domains before configuring them for automated outbound communications.

Next story