<![CDATA[i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser...]]>i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser.com or similar.

The answer, is at least 3 different orgs in the hour that I've owned that domain and been listening for email.

And yes, all of those emails contain the actual PII of the person who has been 'deleted' πŸ˜„

]]>https://forum.other.li/topic/668d08c6-eb71-4497-933d-dccef9a10eb4/i-was-quite-surprised-to-discover-that-no-one-had-registered-deleteduser-dot-com-and-was-curious-to-see-how-many-emails-i-d-get-if-i-registered-it-assuming-many-orgs-delete-logic-probably-just-overwrote-the-email-address-with-blahblah@deleteduser...RSS for NodeMon, 20 Apr 2026 20:09:02 GMTTue, 14 Apr 2026 19:29:09 GMT60<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 15:37:46 GMT]]>@SecureOwl πŸ˜—πŸ‘Œ

]]>https://forum.other.li/post/https://hellions.cloud/users/dannotdaniel/statuses/116409464697135255https://forum.other.li/post/https://hellions.cloud/users/dannotdaniel/statuses/116409464697135255Wed, 15 Apr 2026 15:37:46 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 15:09:55 GMT]]>@SecureOwl@infosec.exchange Maybe we should also check deletedaccount

]]>https://forum.other.li/post/https://mk.absturztau.be/notes/al3r3swhoy3402uxhttps://forum.other.li/post/https://mk.absturztau.be/notes/al3r3swhoy3402uxWed, 15 Apr 2026 15:09:55 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 15:03:50 GMT]]>@SecureOwl HA!

GDPR is a joke. Over under on how many of these companies face repercussions?

]]>https://forum.other.li/post/https://infosec.exchange/ap/users/116407022729669641/statuses/116409331243168720https://forum.other.li/post/https://infosec.exchange/ap/users/116407022729669641/statuses/116409331243168720Wed, 15 Apr 2026 15:03:50 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 14:42:38 GMT]]>And of course the hotel reservations platform is happily spitting out the name of guests and their contact info to the Deleted User email address

]]>https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116409247922311609https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116409247922311609Wed, 15 Apr 2026 14:42:38 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 14:41:38 GMT]]>Up to about 24 different orgs now, overnight had some emails containing PII of 'deleted' users from a:

UAE based Gym Chain
South African HR Platform
EU based Hotel Reservations Platform
India based Delivery Service

and best of all

US based Antivirus Manufacturer and Cybersecurity Provider

]]>https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116409243933163121https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116409243933163121Wed, 15 Apr 2026 14:41:38 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 13:46:45 GMT]]>@womble @SecureOwl Sigh, AFAIK the reality is it is extremely difficult if not impossible to brainstorm the lowest (highest?) level of stupid that will occur in the wild. People tend to apply very simple & limited set of responses to everything in their life, and when operating out of their core familiar domains very few will stop to ponder if what works in the dessert might not work in the ocean.

]]>https://forum.other.li/post/https://mastodon.social/users/CliffsEsport/statuses/116409028162222516https://forum.other.li/post/https://mastodon.social/users/CliffsEsport/statuses/116409028162222516Wed, 15 Apr 2026 13:46:45 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 13:27:19 GMT]]>@kkarhan @briankrebs @SecureOwl @chetfaliszek i think they're fine for automated notifications esp if a reply-to header is given

]]>https://forum.other.li/post/https://mastodon.social/users/ratsnakegames/statuses/116408951722039531https://forum.other.li/post/https://mastodon.social/users/ratsnakegames/statuses/116408951722039531Wed, 15 Apr 2026 13:27:19 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 13:26:33 GMT]]>@SecureOwl What about userdeleted?

]]>https://forum.other.li/post/https://infosec.exchange/users/barubary/statuses/116408948725232122https://forum.other.li/post/https://infosec.exchange/users/barubary/statuses/116408948725232122Wed, 15 Apr 2026 13:26:33 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 12:39:05 GMT]]>@SecureOwl if you wanted you could turn that domain into the next β€œhave I been pwned”, but β€œhave I been not actually deleted”

]]>https://forum.other.li/post/https://oldbytes.space/ap/users/116137989099930418/statuses/116408762081692109https://forum.other.li/post/https://oldbytes.space/ap/users/116137989099930418/statuses/116408762081692109Wed, 15 Apr 2026 12:39:05 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 10:06:04 GMT]]>@xinit @SecureOwl or something under .invalid at least

though if they know about that they probably know to actually erase the data

also i think deleted@invalid is a valid email (since you can just use an apex domain if you have one lying around but almost nobody does) but i reckon a lot of validation regexes reject it

]]>https://forum.other.li/post/https://wetdry.world/users/CauseOfBSOD/statuses/116408160356203177https://forum.other.li/post/https://wetdry.world/users/CauseOfBSOD/statuses/116408160356203177Wed, 15 Apr 2026 10:06:04 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 09:42:20 GMT]]>@SecureOwl I second that 😬

]]>https://forum.other.li/post/https://taur.zone/users/Tamber/statuses/116408067045007566https://forum.other.li/post/https://taur.zone/users/Tamber/statuses/116408067045007566Wed, 15 Apr 2026 09:42:20 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 06:51:09 GMT]]>@cw @paul_ipv6 @SecureOwl to train a markov bot on whatever gets mailed to there would be hillarious but probably not a very good idea

]]>https://forum.other.li/post/https://social.tudbut.de/objects/98d1df9d-84f8-4770-b019-ca8558d524c2https://forum.other.li/post/https://social.tudbut.de/objects/98d1df9d-84f8-4770-b019-ca8558d524c2Wed, 15 Apr 2026 06:51:09 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 06:50:52 GMT]]>@SecureOwl at the very least use deleteduser.the-actual-company-domain.whatever instead of a completely foreign domain name anyone can buy

]]>https://forum.other.li/post/https://mastodon.catgirl.cloud/ap/users/115768608960018230/statuses/116407392846055949https://forum.other.li/post/https://mastodon.catgirl.cloud/ap/users/115768608960018230/statuses/116407392846055949Wed, 15 Apr 2026 06:50:52 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 06:49:31 GMT]]>@SecureOwl β€œβ€β€β€β€deleted”””””

]]>https://forum.other.li/post/https://social.tudbut.de/objects/d10157b3-2188-4875-bde4-99a3d06982echttps://forum.other.li/post/https://social.tudbut.de/objects/d10157b3-2188-4875-bde4-99a3d06982ecWed, 15 Apr 2026 06:49:31 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 04:29:01 GMT]]>@SecureOwl the main reason I don't do well as a pentester is that I never try a lot of things simply because I think "nah, nobody would be that stupid". And then reality proves I am waaaaaaay too optimistic.

]]>https://forum.other.li/post/https://infosec.exchange/users/womble/statuses/116406835075786406https://forum.other.li/post/https://infosec.exchange/users/womble/statuses/116406835075786406Wed, 15 Apr 2026 04:29:01 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 04:18:45 GMT]]>@SecureOwl
What a strange thing for people to do. They could change the email deleted@local or maybe actually delete the data.

]]>https://forum.other.li/post/https://mastodon.coffee/users/xinit/statuses/116406794692514221https://forum.other.li/post/https://mastodon.coffee/users/xinit/statuses/116406794692514221Wed, 15 Apr 2026 04:18:45 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 04:01:52 GMT]]>@qgustavor @SecureOwl One of the domains reserved for testing (effectively) like example.com would do it

]]>https://forum.other.li/post/https://techhub.social/users/diazona/statuses/116406728294809323https://forum.other.li/post/https://techhub.social/users/diazona/statuses/116406728294809323Wed, 15 Apr 2026 04:01:52 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:41:45 GMT]]>i feel an email to the information commissioners office coming on

]]>https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116406649221918452https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116406649221918452Wed, 15 Apr 2026 03:41:45 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:39:49 GMT]]>wow it looks like a major hospitality management platform in europe does this because i just started to get lists of folks and which hotels they are checking in to

good lord people

]]>https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116406641586436276https://forum.other.li/post/https://infosec.exchange/users/SecureOwl/statuses/116406641586436276Wed, 15 Apr 2026 03:39:49 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:36:23 GMT]]>@SecureOwl lol

]]>https://forum.other.li/post/https://mastodon.sdf.org/users/mylesw/statuses/116406628108526468https://forum.other.li/post/https://mastodon.sdf.org/users/mylesw/statuses/116406628108526468Wed, 15 Apr 2026 03:36:23 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:15:38 GMT]]>@petabites

i worked for an ISP that was bidding against NetSol for the registry/registrar stuff. πŸ˜‰

]]>https://forum.other.li/post/https://infosec.exchange/users/paul_ipv6/statuses/116406546527451393https://forum.other.li/post/https://infosec.exchange/users/paul_ipv6/statuses/116406546527451393Wed, 15 Apr 2026 03:15:38 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:14:01 GMT]]>@paul_ipv6

early on with them (my 4 character assigned NIC handle) the NetSol tech guys were ex-NSA iirc, lol

]]>https://forum.other.li/post/https://mastodon.world/users/petabites/statuses/116406540167229845https://forum.other.li/post/https://mastodon.world/users/petabites/statuses/116406540167229845Wed, 15 Apr 2026 03:14:01 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:09:03 GMT]]>@SecureOwl Considering they can't just use null, what could be an acceptable option? @invalid? Although, to be fair, if they can't just null is because something is validating email, so it might require a TLD. Nah... I guess there is no way to rationalize this.

]]>https://forum.other.li/post/https://urusai.social/users/qgustavor/statuses/116406520618797744https://forum.other.li/post/https://urusai.social/users/qgustavor/statuses/116406520618797744Wed, 15 Apr 2026 03:09:03 GMT<![CDATA[Reply to i was quite surprised to discover that no one had registered deleteduser [dot] com, and was curious to see how many emails i'd get if i registered it, assuming many orgs 'delete' logic probably just overwrote the email address with blahblah@deleteduser... on Wed, 15 Apr 2026 03:05:21 GMT]]>@petabites @SecureOwl

the number of things network solutions tech support can't figure out would fill a book... πŸ˜‰

]]>https://forum.other.li/post/https://infosec.exchange/users/paul_ipv6/statuses/116406506046541911https://forum.other.li/post/https://infosec.exchange/users/paul_ipv6/statuses/116406506046541911Wed, 15 Apr 2026 03:05:21 GMT