Researcher Registered Lapsed Domain Receiving Business Email and DMARC Reports for JE Pistons and Wiseco
Summary
A researcher who registered lapsed doverpmi[.]com received 800+ business emails and DMARC reports for JE Pistons and Wiseco. JE later removed its reporting address; Wiseco still points to the domain, but inbound mail is now rejected.
Key points
- The researcher registered the former corporate domain doverpmi[.]com and configured a catch-all inbox, which received more than 800 messages, including business correspondence, phishing and fraud.
- DMARC reporting records for jepistons[.]com and wiseco[.]com directed aggregate reports to the lapsed domain. The reports revealed sending services, infrastructure, message volumes and SPF/DKIM results.
- The author also observed authenticated third-party business mail routed to doverpmi[.]com through legacy forwarding or aliases.
- A password-reset email for a former employee’s SAP account briefly reached the inbox; its recipient and token were redacted. The author says no systems were accessed and captured data was not used.
- In a September update, JE Pistons had removed its reporting address and set its record to p=none with no reports. Wiseco’s record was unchanged, but the author says all inbound mail to doverpmi[.]com is now rejected.
- The article recommends repointing DMARC reporting addresses, auditing DNS and forwarding references to retired domains, migrating external accounts, and retaining retired mail domains defensively.
Article Details
- Attack Vectors
- Re-registering an abandoned corporate email domain that is still referenced by live DMARC reporting records can redirect aggregate reports to the new registrant.
- A catch-all inbox on the re-registered domain can receive mail addressed to former employees, including business correspondence and messages forwarded from other companies.
- Password-reset and account-notification emails sent to former employee addresses on the abandoned domain can expose account-recovery links to whoever controls the domain.
- Forgotten forwarding rules and aliases can redirect authenticated business mail to the abandoned domain.
- Defensive Notes
- Move every DMARC rua and ruf reporting address off domains the organization no longer controls; verify the destination is operational and controlled.
- Audit DNS records, including DMARC, SPF, MX, and CNAME references, and review forwarding and alias rules for references to retired domains.
- Inventory external accounts and notification contacts associated with retired-domain addresses, migrate them, and delete accounts belonging to departed employees where appropriate.
- Retain control of domains that have carried mail; the article recommends a null MX, a hard -all SPF policy, and a p=reject DMARC policy for retired domains.
- Review domain-registration and acquisition or rebranding processes to identify retired domains that remain referenced by live records or external accounts.
People
Vendors
Klaviyoparsing the feed for one brand showed most traffic routing through a single marketing platform (Klaviyo), with an internal MTA cluster of several servers and a Microsoft 365 tenant handling a few thousandSAPthrough the domain, a live password reset for a former employee's account at a major enterprise vendor (SAP), then re-enabled rejection. Here is that reset, with the recipient, the date, and the entire reset token