abuse@, postmaster@, hostmaster@ mails were meant to be present for this, but nothing is enforcing s domain to serve email.

▲

Aachen 13 hours ago | parent | next [-]

Not enforced no, but this works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications

(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is an effective contact method if you're facing a bulk problem like this I suppose. Maybe try just one prefix at a time until an email is accepted)

▲

vntok 14 hours ago | parent | prev [-]

Surely those addresses are compromised in most cases where the server itself is compromised?

	▲	Aachen 14 hours ago \| parent [-]
		Very few people host email, and even fewer in the same VM as where their website is. I would be surprised if this is the case for even 1% of the sites, and attackers probably are exploiting sites by the hundreds, not babysitting and monitoring the email traffic of one of them to quickly delete any vulnerability reports coming in