security research · reverse engineering · curiosity

interpünkt

Assumptions are attack surface.

I research the weird edges of systems: placeholder domains, forgotten endpoints, unexpected trust, and the things everyone assumes are safe.

Explore the research DEF CON 34 talk ↗
Featured research

placeholder squatting

“Just because it says noreply does not mean no one is reading.”

Placeholder squatting is registering or claiming an identifier that exists only as a placeholder or convention, before its legitimate use, to intercept traffic, data, or trust.

The research started with noreply.us, grew into noreply.net, and expanded into a broader study of placeholder domains that real systems still send mail to.

Read the research ↗ View the tooling ↗ 
$ placeholder_squatting_probe.py

> generate candidates
> resolve MX / A / AAAA
> probe SMTP
> verify catch-all
> record results

STATUS: FOUND
noreply → not necessarily no one
37,255emails received at noreply.us
401,796emails received at noreply.net
7,136placeholder domains probed
600confirmed catch-all domains · 8.4%
DEF CON 34 talk dataset, updated 07/30/2026.
Talks

DEF CON 34 · 2026

You've Got Mail
(That Was Meant For No One)

From a catch-all domain registered on leap day to an accidental honeypot receiving password resets, internal tickets, service orders, credentials, attachments, and other mail intended for someone else.

Talk page ↗ Slides ↗
Tools & projects
./probe

placeholder_squatting_probe.py

Generate candidate placeholder domains, resolve mail infrastructure, probe SMTP behavior without sending message data, test catch-all behavior, and record results.

Source on GitHub ↗
noreply.*

Placeholder Squatting

The research site for the broader class of placeholder identifiers that become liabilities when conventions collide with real ownership.

Visit placeholdersquatting.com ↗
~/notes

Research notes

Writeups, experiments, security research, and other things that became interesting after asking one more question.

Read cory.so ↗
About

Cory Solovewicz
aka interpünkt

I’m a security researcher focused on the places where conventions, defaults, and assumptions become real attack surface. My work spans application security, reverse engineering, tooling, and experiments that start with “what happens if this supposedly unused thing is actually owned?”

My DEF CON 34 research grew from a single catch-all domain into a study of placeholder squatting across thousands of candidate domains.

GitHub ↗ LinkedIn ↗ cory.so ↗ contact[at]cory[dot]so