On a new website, I publicly display an email address, [email protected]. Then I set up an email forwarder in my hostmonster cPanel, so that if the public email address ever became spam ridden then we can chop off the forwarding.

However, the client received a spam message that looked like the following.

To: client's personal email address (not the public address)
Subject: domain.com opportunities
Body: marketing junk

The problem is that the "to" should have said [email protected]. I am now worried that the real email address was retrieved on the backend of hostmonster.

3 Answers 3


I wouldn't worry to much. My own research shows that spammers tend to pick up on new domain registrations and send their junk to whatever email address is in the whois. I simply added [email protected] and no more spam for me on new domain registrations.

  • ach! i realized it's from this whois lookup. i'm sort of kicking myself now. i feel like the original email account is ruined. thank you.
    – mrtunes
    Mar 11, 2013 at 14:48
  • Even if you take extra steps such as advised DKoated suggested in Alias guessing there's still a chance that later on it'll receive spam if emails are leaked. Take Sony as a big example, they had 15million email addresses stolen as well as other information. Best of getting a good spam filter and ignore the rest ;) Mar 11, 2013 at 14:57
  • Just added a possible solution for your client to prevent spam in future, or least minimize it. Mar 11, 2013 at 15:00
  • is having the person access their email through gmail the best system these days?
    – mrtunes
    Mar 12, 2013 at 14:22

As DKOATED stated, the spam email had to come from the bots looking up new domain registrations and the WHOIS information of the domain.

Sense you had to create the [email protected] email after you chose and setup your domain and web hosting package, you had to have used the personal email address which you did not want public.

My suggestion would be go and change the domain records to the [email protected] for the domain which you have registered. If you don't know how to do that, you can ask your web host company's support to walk you through that process.

That I believe that should take care of any more spam that could arise in the future. There may be an occasion here or there from the spam bot(s) that already recorded the personal email address sending you another email, but it is very unlikely.

Please Note: I have owned, and still own about 20 domains myself. I get these emails at least once a month about some spam bot(s) wanting to offer money for my domain or some service to help me build a website at the domain it finds. It's no big deal at all.


You can check the logs of access to the backend of the cpanel and see if access entries but in all honesty its very unlikely.

Since its a personal account he/she has most likely used it on a site somewhere which has been compromised and ended up in some kind of database. If this email address has never been used then yes I'd lean towards the site being attacked but since your client is using the email address then this is more likely.

Edit: Cpanel doesn't provide a very good spam protection, if you want better filtering then signup to Gmail Apps which your client can use his domain name on the gmail service which has good filtering of spam. It's also free, up to 10 accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.