Keep the noise out of your inbox
Give every source
a different email address
Wondering which website exposed your email address? Start by keeping addresses separate.
Track which address you gave to which site, so the next suspicious message gives you another clue to check.
This page is a local planning tool, not a data-breach lookup or website-scanning service.
Seeing the route
doesn’t reveal the cause
If you’ve used the same main email address on dozens of sites, that address alone can’t tell you who exposed your data. This page won’t search external sites or access your inbox, and it never needs your email password or verification code.
From now on, use a unique address for each source to narrow down where messages may be coming from. For example, if an alias you gave to one retailer receives unfamiliar marketing emails, that address may have circulated through a related signup, a partner, or another route.
Partner sharing, address guessing, your own public posts, or a compromised device could lead to similar results. Keep recorded facts separate from your assumptions.
A log stored only on this page
Source tracking workspace
Log the purpose first, then enter the address you actually used.
This won’t create an email address or send your log anywhere.
Best for ongoing email and monitoring future messages. Create a real alias in the dashboard first, then enter it in the table below.
Your source log
0 recordsYou can edit every field. Enter the address you actually created and gave to the site under “Assigned address”; leave it blank if you haven’t assigned one yet. The log date defaults to today, but you can change it to the date you actually used the address.
No sources logged yet
Enter a name and purpose above to add your first row. Records stay only on the page while it’s open.
| Source and purpose | Date used | Assigned address | First suspicious email notes | Actions |
|---|
Log entries exist only in this page’s memory. They aren’t saved to persistent browser storage or uploaded by this tool. Refreshing, closing, or leaving the page may erase them, so export a copy if needed. CSV files include the addresses and notes you entered; store them carefully and don’t include passwords, verification codes, or full email contents.
One source, one unique route
For long-term tracking, what matters isn’t the alias name—it’s not giving the same address to multiple sources. Otherwise, if something looks suspicious, the clues get mixed together.
We recommend creating an alias in the dashboard and logging it right away, before entering it on the site. When changing the address on an existing account, complete any required verification and check that expected notifications still arrive.
Example of address separation · addresses not created
shopnote2041@hushinbox.com
newsdesk5512@hushinbox.com
Check which alias a suspicious email was originally sent to, then compare it with your log. Disable only the route causing problems.
Temporary email works for short-term signups, not long-term tracking
For a one-time verification code or test message, you can use a temporary email. New addresses last 3 hours by default, and each extension adds another 3 hours. When an address expires, the address and its emails are deleted. You can’t use it to monitor later marketing emails, and an exported log can’t restore the mailbox. For ongoing notifications, account recovery, or long-term tracking, choose an address you can keep control of.
Check first, then draw conclusions
Why am I suddenly getting so much spam?
A sudden increase is an observation,
not proof that a particular source exposed your data.
First check which address the email was actually sent to, then compare it with the signup date, purpose, and your marketing consent. The displayed sender name can be spoofed, and a message mentioning a retailer doesn’t prove it came from that retailer.
-
Check the delivery route
Open the message details or original email headers and look for available fields such as To, Delivered-To, and X-Original-To. Compare them with the address in your log. Different services retain different fields, and BCC or forwarding may mean To doesn’t show the original address. If the information is incomplete, mark it “unconfirmed” rather than guessing.
-
Check your records from when you shared the address
Review the log date, account settings, signup confirmation, and marketing preferences you selected at the time. Did you also use the address on other sites, public pages, or shared spreadsheets? In “First suspicious email notes,” record the date you noticed it, the sender’s domain, and a brief subject summary. There’s no need to copy the whole message.
-
Separate what you saw from what you think it means
You could write: “On Oct 21, this unique alias received an unfamiliar promotional email; only one signup source is recorded.” Don’t jump to “This website sold my data.” If you need to report the issue or investigate further, keep the original email and relevant signup records, and share them with the service through a safe channel.
| Possible explanation | What to check | What you can conclude |
|---|---|---|
| Original subscription | Did you sign up? Check the marketing settings in your account and whether the email came from a known official domain. | Forgetting that you subscribed doesn’t mean there was a data breach. Use the official unsubscribe option for a service you recognize. |
| Sharing through a partner | Check whether the signup terms and privacy notice name partners, and whether the email explains where your data came from. | A clause in the terms doesn’t prove that data was shared. Check what was actually done and the scope of your consent. |
| Address guessing or public scraping | Check whether the address prefix is common, whether the address appears on public pages, and whether you’ve reused it. | Even a unique address can be guessed or obtained through another channel; you can’t rule these possibilities out. |
| Suspected data exposure | Look for a public notice from the service, a credible security advisory, or multiple records that corroborate each other. | A suspicious email can support a suspicion, but proving a breach and assigning responsibility requires more evidence. |
Not sure what “phishing,” “sender spoofing,” or “email headers” mean? Start with our spam glossary. Don’t reply to suspicious messages, open attachments, or click links in them to verify where they came from.
Before you silence the noise,
save the messages you still need
An alias is a route you can turn off, not a filter that blocks only marketing. Once disabled, legitimate emails sent to that address will stop forwarding too.
-
Save the records you need
Export your log first, and save the original suspicious email in your own inbox if needed. The email forwarding dashboard keeps messages for 30 days; don’t treat it as a permanent evidence archive. This page can’t access or back up those emails.
-
Manage your account on the original site
Go to the account settings through the official website address you already know. Update important notifications and recovery details, then confirm the new address works. If a retailer you recognize is simply sending too much marketing, you can unsubscribe without immediately shutting down the whole email route.
-
Disable or delete the alias in the dashboard
After signing in, find the relevant alias and disable it to stop future forwarding. Delete it only when you’re sure you no longer need it. Don’t assume you can recover the same address after deletion, or that emails missed before disabling will arrive later.
-
Update your log so you’re ready next time
Note the date and reason you disabled the alias, then export an updated copy. Before giving the original site a new address, decide whether you still trust the service. Changing your address won’t close your account, withdraw consent, or delete data the site already holds.
Source tracking: frequently asked questions
Can I enter my main email address to find out which website exposed it?
No. This page doesn’t search breach databases, and a reused address can’t reveal every step along the way. Unique addresses help you build clues from now on. If you’ve received a credible breach notification, follow the service’s official guidance to secure your account.
Will adding a row here create a real email address?
No. A row is just a planning record, and “Assigned address” is blank by default. To get a temporary address, go to the inbox on the homepage; to create a long-term alias, use the email forwarding page and enter the address you actually use in your log.
Can this tool detect suspicious emails or sync records with the dashboard?
No. This tool doesn’t access your inbox, call external scanning services, or sync with the dashboard. You need to check the date and notes for the first suspicious email yourself. Leave them blank if nothing has turned up; don’t treat “nothing seen yet” as “definitely safe.”
Is the log saved automatically?
No. Records stay in this page’s memory and may be lost if you refresh, close, or leave the page. Export a CSV first if you need to keep them. The exported file includes the information you entered, so save it on a trusted device. This page doesn’t support importing files or syncing across devices.
If a unique alias receives unfamiliar marketing, can I report the sender for selling my data?
You can ask the relevant service how it handled or shared your address, but describe what you observed accurately rather than presenting an unverified theory as fact. Source tracking isn’t a forensic investigation and can’t, by itself, prove a data breach, a sale of data, or legal liability.
Should I use a different address for every website?
If you want to distinguish sources, use a unique address for each site where possible, and avoid sharing it publicly elsewhere. Reusing one alias on multiple sites makes the clues less useful. Important accounts also need reliable recovery options and two-step verification; keeping addresses separate alone won’t protect your account.
Use a unique address for your next signup
Use an alias for ongoing email and a temporary address for a one-time code. Log where you use it before deciding who to share it with.