I went looking for one wrong email address and found six wrong domains.
They had been in production for months, across six different server functions. Nothing had ever complained, because there was nothing in the stack capable of complaining. Every one of them was valid code.
What was actually there
Three distinct hosts, none of which I own.
The first was the .com version of my own brand, which I have never owned — the site runs on a different TLD. Somewhere along the way, generated code decided the .com was the obvious address and used it anyway: in a contact-form reply telling users to email support there, and in admin links inside security alerts.
