Discussion
i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with [email protected] or similar.
The answer, is at least 3 different orgs in the hour that I've owned that domain and been listening for email.
And yes, all of those emails contain the actual PII of the person who has been 'deleted' 😁
Up to about 24 different orgs now, overnight had some emails containing PII of 'deleted' users from a:
UAE based Gym Chain
South African HR Platform
EU based Hotel Reservations Platform
India based Delivery Service
and best of all
US based Antivirus Manufacturer and Cybersecurity Provider
And of course the hotel reservations platform is happily spitting out the name of guests and their contact info to the Deleted User email address
I wrote up this cursed discovery with more details:
https://mike-sheward.medium.com/deleteduser-com-a-15-pii-magnet-c4396eb21061
Thursday must be PHI day - a platform that appears to be used by care workers and psychologists is happily sending patient names and details to deleteduser dot com.
@SecureOwl Shout out to [email protected], which seems to be offline again https://web.archive.org/web/20150306122945/http://bar.com/
@SecureOwl reminds me of donotreply.com and other domains not to be used for that!
@kkarhan @SecureOwl I had to dig up this 2008 WaPo story from Archive since WaPo nuked all my blog posts from their site. It's about @chetfaliszek, the guy who registered donotreply.com.
@briankrebs @kkarhan @SecureOwl @chetfaliszek Also very recently, this talk from the 39C3 (I think this hasn't been in the replies, yet?)
(English translation available)
media.ccc.de/v/39c3-verlorene-domains-offene-turen-was-alte-behordendomains-verraten
@briankrebs @SecureOwl @chetfaliszek oh yesh, I remember that one.
Install bonfire.mavnn.eu
Get the full app experience
