Loading story…
Security researchers who registered abandoned or commonly misused domains such as noreply.net, noreply.us, and deleteduser.com began receiving large volumes of misdirected automated email from companies, exposing a widespread data leakage problem. Reports say one domain alone received 401,796 messages since December 2024—about 700 per day—with mail arriving from thousands of sender addresses and root domains. The messages were generated by corporate systems rather than individual users, showing that many organizations continue to route notifications and workflows to recycled, invalid, or poorly controlled addresses.
The unintended emails reportedly included sensitive business and personal information, attachments, HR requests, hotel bookings, Zoom invitations, and other internal communications. Researchers said the issue stems from weak email hygiene, poor account deprovisioning, and unsafe use of placeholder or supposedly non-monitored addresses in automated systems. The findings highlight an avoidable exposure risk that can be reduced through stricter auditing of outbound email flows and the use of internal-only or guaranteed-invalid domains for non-deliverable addresses.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Sheward said deleteduser.com received emails from three different organizations within the first hour after he bought the domain, indicating some companies had not fully removed old addresses from their systems.
Mike Sheward, head of security at Xeal, bought the deleteduser.com domain earlier in the year for about $15 to observe whether organizations were still sending mail to deleted-user placeholder addresses.
Since December 2024, one of the domains monitored by the researchers reportedly received 401,796 messages, averaging about 700 emails per day and containing sensitive corporate information.
Cory Solovewicz bought the noreply.net domain in 2024, adding it to his monitoring of placeholder-style domains that organizations mistakenly treat as unreachable. He later observed large volumes of misdirected automated email sent to the domain.
Cory Solovewicz said the noreply.us domain he owns has received 37,255 messages over 2,345 days since he purchased it in 2020, showing the placeholder-domain email leakage problem has persisted for years.
A researcher re-registered the expired domain gca-emailauth.org for $10 and began receiving DMARC aggregate reports from 86 domains across more than 20 organizations, including 56 domains belonging to The Toro Company. The stale reporting endpoint had appeared in Global Cyber Alliance DMARC training materials dating back to 2019.
After the expired gca-emailauth.org reporting endpoint issue was noticed, the University of Wisconsin–Stevens Point removed the rua tag from its DMARC configuration while retaining a p=reject policy. This reflects a concrete remediation step by one affected organization.
Solovewicz said he has been notifying affected companies that their systems are sending sensitive automated emails to domains he controls and urging them to correct the misconfigurations.
Security researchers Cory Solovewicz and Matt Bryant bought inexpensive domains including noreply.net and deleteduser.com and configured them to receive inbound traffic, passively collecting emails misaddressed by corporate systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcereddit.com
Open sourcereddit.com
Open sourcesh.consulting
Open sourcescworld.com
Open sourcearstechnica.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have exploited insufficient authentication controls in widely used web-based platforms to launch large-scale spam and email bombing attacks. In one case, attackers abused the customer service platform Zendesk, which allows some customer accounts to accept support requests from anonymous users without prior verification. This configuration enabled malicious actors to generate thousands of ticket creation notifications, which were then sent from the domains of legitimate Zendesk customers such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder. The emails, which could contain any subject line chosen by the attacker, included threatening messages and personal insults, and appeared to originate from the customer’s own domain, increasing their credibility and impact. The reply-to addresses in these emails were set to the legitimate support addresses of the affected organizations, further complicating mitigation efforts. Zendesk acknowledged the abuse and stated that while they recommend customers restrict ticket creation to verified users, some organizations opt for anonymous submissions for business reasons, inadvertently exposing themselves to this type of attack. Separately, a massive spam campaign was uncovered on a client’s website due to the misuse of a contact form feature that allowed users to send a copy of their message to themselves. This seemingly innocuous feature was leveraged by attackers to generate 149,700 spam emails, overwhelming the server’s resources and causing significant performance degradation. The investigation revealed that the emails were being generated locally on the server using PHP scripts, with all messages appearing to come from the legitimate website domain. The server’s email queue became saturated, and the high volume of outbound spam led to complaints from recipients and potential blacklisting of the domain. Both incidents highlight the risks associated with allowing unauthenticated or loosely authenticated email submissions in web applications and customer service platforms. Attackers can exploit these features to conduct denial-of-service attacks on inboxes, damage reputations, and disrupt business operations. The technical analysis in both cases pointed to the need for stricter authentication and verification mechanisms for user-submitted forms and support tickets. Organizations are advised to review their platform configurations, disable anonymous submissions where possible, and implement rate limiting and CAPTCHA protections to mitigate abuse. The incidents underscore the importance of balancing user convenience with security controls to prevent exploitation by malicious actors. Failure to secure these features can result in significant operational impact, reputational harm, and increased risk of further compromise. Both cases serve as a warning to organizations using third-party platforms or custom web forms to regularly audit their authentication and submission policies. Proactive monitoring and rapid response to unusual email activity are critical to minimizing the damage from such attacks. The widespread nature of these abuses suggests that many organizations may be unknowingly vulnerable to similar exploitation. Security teams should prioritize the review of all externally facing forms and ticketing systems to ensure robust protections are in place.
Jun 29, 2026
A massive data exposure incident occurred involving Netcore Cloud, an Indian-based global email marketing and automation company, when a misconfigured server left over 40 billion records and 13.4 terabytes of data publicly accessible. The exposed database contained unencrypted mail logs, which included sensitive information such as email addresses, message subjects, internal delivery details, and technical data like IP addresses and SMTP configurations. Among the leaked records were healthcare notifications, banking activity alerts, and employment-related emails, some of which were marked as confidential. The data was accessible to anyone who knew the server’s IP address, posing a significant risk of unauthorized access and potential misuse. The breach affected Netcore Cloud’s global client base, which spans more than 6,500 brands across 40 countries and includes organizations in sectors such as ecommerce, finance, media, and travel. The exposure was discovered by cybersecurity researcher Jeremiah Fowler, who reported the issue after finding the database unprotected and unencrypted. Upon notification, Netcore Cloud responded promptly by securing the database and restricting public access on the same day. The company also requested additional information from the researcher to support its internal investigation. The incident highlights the risks associated with misconfigured cloud infrastructure, especially for companies handling large volumes of sensitive communication data. The scale of the exposure, both in terms of record count and data volume, makes it one of the more significant data leaks in recent times. The presence of confidential and technical information in the logs could facilitate further attacks, such as phishing or account compromise, if accessed by malicious actors. The incident underscores the importance of robust security controls, regular audits, and prompt response protocols for organizations managing critical customer data. Netcore Cloud’s swift action in securing the database likely mitigated further risk, but the exposure period remains unclear. The breach has raised concerns about data privacy and the security practices of third-party service providers in the email marketing industry. Organizations using Netcore Cloud’s services may need to assess their own exposure and consider additional safeguards. The event serves as a cautionary tale for all companies relying on cloud-based infrastructure to ensure proper configuration and continuous monitoring to prevent similar incidents.
Jul 12, 2026
Threat actors have intensified their use of phishing campaigns by impersonating well-known brands and trusted online services to deceive victims and steal sensitive credentials. In one campaign identified by the Cofense Phishing Defense Center, attackers targeted individuals in social media and marketing roles by sending fake job application emails that appeared to originate from major companies such as Red Bull, Tesla, Google, and Ferrari. These emails used convincing language and branding, including up-to-date logos and tailored subdomains, to increase their legitimacy and lure recipients into clicking malicious links. The attackers further enhanced the credibility of their messages by spoofing the sender address to appear as if it came from a legitimate domain, such as Xero, which has been abused in previous phishing incidents. The phishing process often began with a CAPTCHA page to create a sense of security before redirecting victims to fraudulent login pages designed to harvest credentials. This approach demonstrates a sophisticated understanding of social engineering tactics and the value of resume and personal information in targeting specific job seekers. In a separate but similarly themed incident, a Malwarebytes employee was targeted by a phishing email that impersonated 1Password, a popular password manager. The email falsely claimed that the recipient's 1Password account had been compromised and urged immediate action, including changing the account password and enabling two-factor authentication. The message mimicked legitimate security alerts, referencing 1Password's Watchtower feature, but included subtle red flags such as a sender address not associated with 1Password and a malicious link disguised as a legitimate action button. The phishing link directed users to a typosquatted domain, onepass-word[.]com, rather than the official 1Password website. Interestingly, the email's 'Contact us' link routed through a legitimate support page but used a redirect service, further complicating detection. The use of Mandrillapp, a transactional email delivery service, added another layer of apparent legitimacy to the phishing attempt. Both campaigns highlight the increasing sophistication of phishing attacks, with threat actors leveraging trusted brands and services to bypass security filters and exploit user trust. The attackers' use of brand-specific subdomains, authentic-looking graphics, and familiar communication styles makes these phishing emails particularly convincing. By targeting individuals with tailored messages, such as job seekers or users of specific online services, the campaigns increase the likelihood of successful credential theft. The abuse of legitimate infrastructure, such as Xero's email services and Mandrillapp, demonstrates how attackers can exploit trusted platforms to evade detection. Security teams are advised to educate users about the signs of phishing, including checking sender addresses, scrutinizing URLs, and being wary of urgent requests for sensitive information. Organizations should also monitor for abuse of their brand in phishing campaigns and work with email providers to block malicious domains. The incidents underscore the need for robust email security solutions and ongoing vigilance against evolving social engineering tactics. As phishing campaigns continue to evolve, both individuals and organizations must remain alert to the latest techniques used by cybercriminals to compromise accounts and steal valuable data.
Jun 29, 2026