Eden Park (New Zealand national stadium) had its DMARC reports going to an expired domain for years, so I registered it and spent a year reporting the vuln to them with no response

I'm the researcher in this iTnews piece: https://www.itnews.com.au/news/expired-anti-spam-domain-bites-nzs-national-stadium-eden-park-628443

edenpark.co.nz DMARC record had rua/ruf pointing at [abuse@spamcontrol.co.nz](mailto:abuse@spamcontrol.co.nz). That domain belonged to a Fujitsu NZ anti‑spam service retired in 2021, and nobody cleaned up the customer records afterwards.

I registered the domain, spun up an MX, and started receiving their aggregate reports. Within 30 days that gave a clear picture of their sending infrastructure and the ~600 orgs they exchange mail with through the envelope_to field in the XML – Microsoft still reports it.

I saw their sponsors, sports associations, event companies, and the celebrity agents they deal with + who handles their construction projects, who runs traffic control for events, which catering firm they use, how often they talk to gov agencies, and who owns their sales and marketing.

I've been reporting it since Oct 2025 to security contacts, IT managers, the leadership team, NCSC NZ, and personal contacts at NZ MSPs. Nobody fixed it.

Once the public disclosure went live and viral, they fixed it within a day, and Fujitsu reached out. We're now coordinating the domain transfer now.

The point is nobody audits their DNS zone, and every vuln disclosure gets read as a sales pitch.

Happy to answer questions on the technical side.