Every day, we receive password resets, bank confirmations, and medical records meant for you—because you used our domain to sign up for a service you didn't trust.
⚠️ This is a security nightmare for you, and an administrative headache for us.
When you type [random]@notheld.com into a sign-up form to avoid spam, you aren't hurting the corporation—you are hurting yourself.
We receive misdirected emails every day. These include:
Go to any website you use—Netflix, PayPal, Amazon, or your bank. Click "Forgot Password" or "Forgot Username."
Enter your real username or the email address you think you used.
...then you are the person we are talking about. That code went to us, not to you. You are locked out of your own account and relying on a stranger (us) to stay secure.
Fix it now, before that code is for something irreversible.
Open your Gmail/Outlook and search for @notheld.com. You won't find the actual emails (because we have them), but you will find the receipts and confirmation pages from when you signed up. That tells you exactly which accounts are compromised.
Go to your banking apps, social media, and subscriptions. Change the contact email to one you actually control.
If you request a two-factor authentication code and enter our domain, that code lands in our inbox. You will be permanently locked out of that account.
If you want to track who is selling your data, use your real email provider's "plus" feature (e.g., youremail+netflix@gmail.com). This keeps your data safe, lets you filter spam, and actually goes to you.
Stop using @notheld.com in your testing environments, demo data, or seed files. You are polluting our production mail server with thousands of automated test emails.
Use @example.com (which is reserved by RFC 2606 for documentation) or set up a local SMTP trap like MailHog. Do not use live, registered domains for dummy data.