How to Find Where Your Email Is Used and Identify Which Site Leaked Your Data

The short answer: your alias labels are the map

To discover how to find where my email is used and pinpoint which service compromised your data, check the destination address of the unsolicited message against your alias records. If you assign a dedicated, isolated forwarding address to every online service, the alias that received the message names the leaking site immediately.

Aliases stop leaks. An email alias is a durable forwarding address that sits between an external sender and your primary mailbox. When an external service transmits a message, its mail transfer agent delivers to the alias. The forwarding proxy accepts the envelope, records the transaction in an operational log, and relays the payload to your real destination address without exposing that destination to the sender. Under standard email alias forwarding mechanisms, the sender sees only the address they received during registration. Every site gets one address.

To pinpoint a data exposure accurately, your setup requires three components:

• A dedicated, unique email alias assigned to exactly one online service.
• An explicit label or metadata note mapped to that alias inside your management dashboard.
• An accessible delivery log that records the inbound envelope sender, timestamp, and target alias.

If you used a single root email address across hundreds of websites, retroactive tracing is impossible. A standard address contains no origin metadata. When an unsolicited sender buys a list containing that address, nothing in the message headers reveals which of your accounts suffered an unauthorized intrusion or sold its customer records. Stop entering your root address into web forms. Deploy isolated aliases so you can trace email leaks as they happen.

When you maintain strict alias isolation, identifying a leak relies on three verifiable signals:

1. The recipient alias in the To: header and envelope recipient field identifies the specific entity to which you entrusted that address.
2. The originating envelope sender in the delivery log reveals whether the mail originated from that vendor or an unrelated third party.
3. The chronological timing compares the date the alias first accepted unexpected traffic against company disclosures, account signups, or breach notifications.

Step 1: inventory every alias and what it was for

Auditing your digital exposure begins with a complete inventory of every forwarding address you have provisioned. Without a systematic directory, you cannot isolate which service exposed your information when suspicious traffic appears.

Open your records. Within the Emcognito dashboard, navigate to the alias directory. Every alias record maintains four metadata fields that document your audit history: label, note, source, and category. If you prefer to audit your infrastructure programmatically, you can query the REST API:

curl -s -X GET "https://api.emcognito.com/v1/aliases?limit=100" \
  -H "Authorization: Bearer emk_your_api_key_characters_here_43_chars"

This endpoint returns a paginated list using next_cursor and last_key. Export this payload into a local JSON file or spreadsheet. Cross-reference this export against the credential entries stored inside your password manager. Each login entry in your vault should align directly with an active alias.

Adopt a predictable labeling convention that embeds context directly into the alias record. A structure such as [service-name].[purpose].[creation-year] simplifies forensic triage. For example:

• store-checkout-2024: Reserved strictly for transaction receipts from an e-commerce merchant.
• forum-community-2025: Assigned to an online discussion board.
• saas-billing-2026: Bound to an enterprise software account.

Context matters. If an alias with the label store-checkout-2024 receives a marketing pitch for auto insurance in late 2026, the origin of the exposure is clear: the e-commerce store either suffered a database compromise or shared its customer lists with affiliate brokers.

A frequent operational failure occurs when generating addresses on the fly. When you create an address inline using the Chrome browser extension on a registration form, it is easy to skip assigning a label in the moment. Run a sweep of your alias directory once a month to locate unlabeled records and match them against your password manager's newest signups.

Emcognito aliases use the shared emcognito.com domain. Custom domains are not available today; a custom subdomain at handle.emcognito.com is available on Pro. Because your aliases share the base domain, your unique local part and internal dashboard metadata are your primary forensic levers.

Step 2: read the delivery log for the sender, not the subject

Inspect the logs directly. Spam filters and end-user email clients emphasize subject lines, display names, and message previews. For forensic tracing, those fields are irrelevant. Attackers and bulk mailers routinely spoof display names and craft deceptive subjects such as "Invoice Overdue" or "Account Verification Required."

To identify sites with your email that leaked data, you must inspect the raw SMTP envelope captured in the forwarder's delivery log. The delivery log documents the exact transmission handshake between the sending server and the receiving mail exchange:

• Envelope Sender (Return-Path or MAIL FROM) records the authenticated domain dispatching the mail, verified through RFC 7208 Sender Policy Framework checks.
• DKIM Signing Domain (d= value) indicates the cryptographic identity that signed the message body and headers during transit.
• Inbound Timestamp captures the exact second the forwarding server accepted the packet.
• Target Alias Address reveals the unique alias the sender attempted to reach.

When reviewing these logs, you will observe three distinct routing patterns:

First, legitimate third-party infrastructure. If you assigned an alias to an airline, and that alias receives mail from SendGrid or Amazon SES with DKIM signing aligned to the airline domain, this is expected behavior. Modern enterprises delegate marketing campaigns and receipts to cloud email infrastructure.

Second, list syndication and lead generation brokers. If an alias generated strictly for a real estate listing site starts accepting inbound messages from home improvement vendors, mortgage refinancing brokers, and moving companies, the real estate site sold your data. The site itself was not breached; its terms of service permitted commercial redistribution.

Third, unauthorized exfiltration. If an alias issued to an obscure forum begins receiving generic credential harvesting attempts, phishing lures, or adult entertainment promotions from random lookalike domains, the site's database was dumped and circulated across underground clearinghouses.

Footers alter layouts. Free forwards carry a first-party alias status bar, not a sponsor card. Plus and Pro forwards carry no footer. The absence of footers on paid tiers ensures forwarded payloads remain pristine for header inspection.

The table below illustrates how to categorize inbound events based on log data:

Step 3: confirm the leak before you act

Confirm the failure type first. Acting prematurely can complicate account recovery if the target site still requires email verification for sensitive updates.

Consider intrusions carefully. A third party breaches a company's database or storage buckets, extracting records containing user identifiers and email addresses. In this scenario, the alias will receive malicious phishing attacks or extortive spam from disconnected botnets.

Evaluate corporate marketing monetization. A business updates its privacy policy or enters a co-marketing agreement, bundling your address into a customer segment uploaded to a partner platform. In many marketing campaigns, the unexpected email will contain compliant one-click unsubscribe headers that point directly back to the software managing that campaign.

Verify dictionary guessing. If an alias has an extremely simple local part, automated spammers running brute-force dictionary attacks against mail servers will eventually hit it. If you generate high-entropy random identifiers, the probability of an algorithmic collision approaches zero. When a complex random alias receives mail, it was leaked by the entity holding it, not guessed.

Cross-check your findings. Search data breach intelligence repositories such as Have I Been Pwned using the specific alias, not your primary root inbox. If an intelligence platform alerts you that an incident occurred, compare the public disclosure date with the timestamp of the first unexpected message logged in your delivery dashboard. A sudden influx of spam arriving three weeks prior to an enterprise disclosure announcement indicates you were part of the initial exfiltration batch.

Avoid assuming that every spam wave indicates an external hack. If an e-commerce vendor changes its newsletter provider, old aliases may receive reactivation emails from unfamiliar server hostnames. Check the message contents for internal account references, past order numbers, or specific customer IDs. If the message references historical transactions made exclusively with that merchant, the company sent the message internally via an unfamiliar infrastructure partner.

Sharing ruins forensics. If you made the mistake of assigning a single alias to two separate services, you lose forensic clarity. You cannot identify which site leaked your email because either counterparty could be responsible. In that case, retire the shared alias entirely and provision two distinct addresses.

Step 4: shut off the leaked address without losing the account

Once you identify the compromised alias, your priority is revoking unauthorized access to your communications without locking yourself out of the underlying service.

Do not delete the alias immediately. Deletion breaks the connection permanently. If the site requires two-factor email challenge codes or password resets in the future, a deleted alias bounces incoming mail, which can permanently orphan your account credentials.

Execute this remediation sequence:

1. Log in to the service using your current credentials while the alias remains active.
2. Navigate to your alias dashboard or generate a replacement address inline with an explicit label.
3. Update your registered email address inside the service's account profile and confirm the verification link.
4. Return to the forwarder dashboard, locate the compromised address, and select Pause alias.

Pausing is immediate. When paused, the mail proxy drops inbound connections targeting that local part at the SMTP receipt stage. The sender receives an operational delivery failure or a silent drop depending on system configuration, and zero mail reaches your primary inbox.

Deleting an alias asks for a confirmation prompt. It is not a one-click action, and it cannot be undone. Pausing is the superior forensic choice because you can temporarily unpause the address for five minutes if you discover a secondary service was inadvertently tied to that address.

Understand the exact scope of the developer tools. Suspending, resuming, and deleting aliases are actions reserved exclusively for the web dashboard. The v1 REST API has no PATCH, PUT, or DELETE endpoints, and there is no /v1/aliases/{id} resource. Automations can provision and list aliases, but pausing and deleting require administrative action in the web console.

Where alias services differ on tracing

Evaluating alias providers requires looking beyond top-level feature matrices to examine operational architecture. Privacy-focused users typically weigh standalone forwarders against solutions bundled within operating systems or password managers.

Coupled tools limit portability. Bundled solutions like Apple Hide My Email or Proton Pass integrate aliases directly into platform ecosystems. While convenient for casual browser signups, this integration introduces vendor lock-in. If you migrate from iOS to Linux, or change password managers, your alias routing table becomes fragmented across proprietary interfaces. Standalone forwarding services maintain your email routing independently from your credential store, allowing you to switch operating systems, browsers, and vault software without breaking inbox routing.

Hosting models also diverge. Emcognito is closed source and runs only as a hosted service; if open source or self-hosting is a requirement, addy.io is the better fit. Self-hosted instances give administrators complete control over Postfix queues, but require ongoing maintenance of IP reputation, reverse DNS records, and spam hygiene.

When selecting a platform to trace leaks, the deciding factor is log visibility. A service that routes mail silently without exposing sender headers, delivery statuses, or rejection timestamps prevents you from auditing source leaks. An unread log traces nothing. Choose a system that exposes clean delivery records so you can verify who sent what, and when.

If you are reviewing other providers to handle your routing setup, explore our detailed comparison of SimpleLogin alternatives to assess features across platforms.

The limits that decide whether this works at scale

Maintaining an isolated alias for every digital relationship requires understanding the structural quotas enforced by your forwarding provider. Tracking leaks fails if a service throttles account creation or caps total alias inventories.

Inventories remain unrestricted. On Emcognito, the number of aliases an account can hold is completely unlimited on every tier, including Free. You do not hit a wall where you must prune old accounts to add new ones. What is metered is inbound forwarded email volume and daily alias creation velocity. Source: Emcognito source.

The operational tiers break down as follows:

• Emcognito Free provides unlimited aliases, with 35 forwarded messages per month for accounts created on or after 2026-10-19. Accounts created prior to that date maintain a 100/month forward quota, and referral bonuses can raise the cap to at most 200. No credit card is required. Dashboard creation is capped at 200 aliases per day. Free forwards carry a first-party alias status bar, not a sponsor card.
• Emcognito Plus provides 2,500 forwarded messages per month with no status bars or footers. The plan includes the developer API capped at 50 programmatic creations per day and unlocks composing brand-new mail from any alias, allowing up to 20 outbound messages daily.
• Emcognito Pro provides 15,000 forwarded messages per month, developer API access at 200 creations per day, and up to 100 composed outbound messages daily. Pro yearly includes three months free and represents the best annual value.

For complete breakdown details on forwarding caps and feature allocations, review our current pricing and plan specifications.

Creating new aliases via the graphical dashboard is capped at 200 per day across all tiers, Free included. This prevents automated spam scripting while giving power users ample headroom to bulk-migrate accounts from a password manager export.

Outbound composing and inbound forwarding share the same underlying pool. Every outbound message composed from an alias counts against your monthly quota, drawing on the same allocation that incoming forwards rely on. Composing and forwarding are not independent meters.

Reply timelines are defined. Reply securely in the delivery log is included on every Emcognito plan until November 3, 2026, and on Plus and Pro from then on. Replying from your own mail app is a Plus and Pro feature.

On Plus and Pro, you can hit Reply directly in standard email software on any forwarded message. Emcognito receives the outbound transmission, confirms that it originated from your verified account sign-in mailbox with passing SPF and an aligned DKIM signature, and rewrites the headers so the email leaves from your alias. Mail forwarded before October 5, 2026 carries no reply address. On Free, attempting to reply directly from an external mail app returns a delivery failure containing an upgrade message.

Automating the trace with the alias API

Programmatic workflows speed up provisioning. The developer tools allow you to generate labeled aliases during deployment or sign-up flows. Embedding origin metadata into script deployments simplifies automated tracking.

The API surface is clean and focused. The base URL is:

https://api.emcognito.com/v1

There is no /api/v1 route. Authentication requires a bearer token passed in the standard header:

Authorization: Bearer emk_your_api_key_here

Keys stay consistent. API keys begin with the literal prefix emk_ followed by 43 URL-safe characters. There is no live/test environment split. The key interacts directly with production routing.

To provision a new alias programmatically, dispatch an HTTP POST request to the /v1/aliases endpoint with optional metadata attributes:

curl -s -X POST "https://api.emcognito.com/v1/aliases" \
  -H "Authorization: Bearer emk_your_api_key_characters_here_43_chars" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "cloud-monitoring",
    "note": "Production alert ingest service",
    "source": "ci-deploy-script",
    "category": "infrastructure"
  }'

POST /v1/aliases returns HTTP 200 with the new alias under "alias". The burst limit is 60 requests a minute per key; its 429 carries a Retry-After header giving the seconds until the window resets. The daily alias-creation cap (50 on Plus, 200 on Pro) resets at 00:00 UTC and its 429 carries no Retry-After. Emcognito sends no X-RateLimit-* headers.

A successful response returns a payload structured as follows:

{
  "alias": {
    "id": "al_94810a4fbc82",
    "address": "k8s-alert-9f3a@emcognito.com",
    "status": "active",
    "created_at": 1792982400,
    "forward_count": 0,
    "label": "cloud-monitoring",
    "note": "Production alert ingest service",
    "source": "ci-deploy-script",
    "category": "infrastructure",
    "single_use": false,
    "expires_at": 0
  }
}

Notice the payload data types. The created_at property is an integer Unix epoch timestamp, not an ISO-8601 string. Unset string parameters return as empty strings (""). The response does not use a top-level data wrapper.

The Python script below illustrates how to automate an audit. It retrieves all active aliases, sorts them by their lifetime forwarding counters, and flags any dormant address that suddenly received inbound traffic:

import requests

API_KEY = "emk_your_api_key_characters_here_43_chars"
BASE_URL = "https://api.emcognito.com/v1/aliases"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def audit_alias_traffic():
    aliases = []
    cursor = None
while True:
    params = {"limit": 100}
    if cursor:
        params["cursor"] = cursor

    resp = requests.get(BASE_URL, headers=HEADERS, params=params)
    if resp.status_code == 429:
        retry = int(resp.headers.get("Retry-After", 60))
        print(f"Rate limited. Waiting {retry} seconds...")
        continue
    elif resp.status_code != 200:
        print(f"Failed retrieval: {resp.status_code} {resp.text}")
        break

    data = resp.json()
    aliases.extend(data.get("aliases", []))
    cursor = data.get("next_cursor")
    if not cursor:
        break

print(f"Auditing {len(aliases)} total aliases...")
for item in aliases:
    if item.get("forward_count", 0) > 0 and item.get("category") == "archive":
        print(f"ANOMALY: Archived alias {item['address']} ({item['label']}) has received {item['forward_count']} messages.")

if name == "main":
    audit_alias_traffic()

To integrate automated creation and audit workflows into your infrastructure, consult the complete developer API documentation.

A repeatable monthly audit

Maintaining clean inbound routing does not require constant oversight. Implement a fifteen-minute monthly maintenance routine to keep your address mapping accurate and trace email leaks systematically.

Minutes 1 to 5: sort by forwarding velocity. Open your alias directory and sort by total forward counts. Check which addresses accepted inbound messages over the preceding thirty days. If an alias created for a one-off home purchase or an archived software subscription suddenly records traffic, open the delivery log to inspect the sender domain.

Minutes 6 to 10: triage unexpected senders. If the delivery log reveals unprompted marketing material or phishing runs sent to a vendor-specific alias, mark that address for deactivation. Log in to the service, update the profile to a freshly generated alias, confirm the verification token, and select Pause alias on the compromised record.

Minutes 11 to 15: clean unmapped entries. Match registered aliases from your browser extension against your password manager vault. Add missing labels, assign appropriate categories, and verify that no accounts share a single forwarding address.

Habits preserve forensic control. Once you execute this review cycle twice, investigating leaks ceases to be speculative guesswork. The operational log turns every unexpected message into an open forensic record.

Frequently asked questions

Where is my email used?

To identify every location where an email address is actively registered, audit your password manager vault, search your primary