How Exposed Is My Email? Inside an Exposure Score

By Ahsan

An email exposure score is a single number that summarises the exposure of a user's alias fleet. AliasFleet computes the score from the telemetry of the fleet and presents it on a scale from 0 to 100, where 0 represents perfect privacy and higher numbers represent greater exposure. The score is a Pro feature, and it is accompanied by a breakdown of the inputs that produced it and a short explanation generated from those inputs. The number measures the alias fleet, and the destination inbox remains outside its scope.

Inputs

The breakdown behind the score contains eight fields, each drawn from the alias fleet and its inbound mail. The zombie count records aliases that remain active after the service they were created for has stopped being used. The spam ratio is the share of inbound mail classified as spam, expressed as a percentage. The identifiable alias count records aliases that contain the user's real name. The data broker correlation count records domains that correlate with data broker activity. The stale active count records aliases that remain active while unused.

The tracker count records tracking pixels stripped from forwarded mail. Two lists support the counts: the domains that send the most spam to the fleet, and the sender domains correlated with broker activity. Each field is a count or a share taken from the fleet itself, and the computation uses telemetry the service already holds rather than information supplied for the check.

Scoring

The score runs from 0 to 100, and lower numbers indicate less exposure, which reverses the direction of most security scores. A score of 20 or below carries the status Strong Privacy. A score from 21 to 45 carries the status Moderate Exposure. A score from 46 to 70 carries the status High Risk. A score above 70 carries the status Critical Exposure. The underlying risk level takes one of four values: low, moderate, high or critical.

The widget draws the number as a ring with the score as the filled arc, and it colours each band green, yellow, orange or red from the lowest band to the highest. A score above 20 displays the factors that contributed to it: broker correlations, zombie aliases and a spam ratio above 30 percent appear with a red marker, while real-name aliases and stale aliases appear with a yellow marker. A score of 20 or below displays the clean signals instead: zero broker correlations, no leaked or zombie aliases, and no real-name alias formats where the count is zero.

Regeneration

The score is computed on demand through a POST request to the exposure-score endpoint, which proxies the request to the scoring service. A request without a refresh flag returns the stored score, and a request with the refresh flag set recomputes it. Each recomputation consumes one unit of the account AI quota. The response carries the score, the risk level, the breakdown, a short explanation and the time of the last update, and the widget displays that time beside the scale. The feature is gated by subscription tier: Pro accounts receive the live score, while other accounts receive a preview card with a sample score of 15 and a list of the checks the full assessment would run.

Limits

The score measures only what the alias fleet and its mail can observe. When the fleet has received no mail, the spam ratio, the zombie count and the broker correlation count are all zero, and the widget states that it is awaiting email traffic to map behavioural risks. The score is also a snapshot: it carries the time of its last computation, and it moves as new mail arrives or as aliases are paused, rotated or removed. The inputs contain no credential or authentication factors, so the score says nothing about the strength of the passwords on the accounts behind the aliases or about whether two-factor authentication is enabled on the destination inbox. A low score records low values across the measured inputs, and the destination inbox remains a separate matter.

Other scoring systems

Exposure scoring is not unique to alias services. XposedOrNot runs a free breach search that returns a risk score for an address, and its index lists 835,955,029 exposed email addresses, with the most recent breach added on 9 November 2026. NordVPN also scores digital footprint exposure from 0 to 100, with 0 representing low exposure risk and 100 representing high exposure risk, and it draws on open-source intelligence and dark web monitoring. The difference between those systems and an alias fleet score is the source of the inputs: breach checkers measure an address against external breach records, while the alias score measures the behaviour of the fleet itself, including which aliases still receive mail and which senders dominate the spam. The two measurements draw on different inputs, and the alias score does not replace a breach lookup.