I've been getting emails at my work address for the past year from a company I don't remember subscribing to (especially not with my work email address). I've reported it as spam, but got a reply from my company saying it's a real company.

I'm dubious, and I've read that you shouldn't click unsubscribe from emails you don't remember subscribing to as it alerts spammers that it's a live address, so I set up a filter to auto-delete the emails.

However, the emails keep changing. The email address in the from field changes, or the name of the company changes slightly, etc. Eventually, new emails slip through, and I have to set up a new filter. Also, the URL in the unsubscribe link changes with every email. The email itself always contains a link to a document to read about the latest technology updates in (my field), but the URL always ends in ?email=(my email address)?from=(number). (At least I assume it's a document, I've never clicked on one.)

I feel like a reputable company wouldn't do something like this, and so I'm still hesitant to unsubscribe. The people the emails are from seem to have LinkedIn profiles, but I've also found some other posts suggesting it might be spam.


Am I being over-paranoid? Should I just unsubscribe?

In a more general case, what things can I do to work out if an email is safe to unsubscribe from?

2 Answers 2


There are two approaches to consider here, and they're not mutually exclusive.

First, try to determine if the entity facilitating the unsubscribe mechanism is a reputable Email Service Provider (ESP). This is, sadly, a really hard thing to determine; most ESPs do everything they can to look reputable. If they're listed as Certified Senders Alliance participants or M³AAWG members, they're reputable. However, not being listed in either doesn't mean they're abusive! It means you have no easy answer: you're going to have to figure that out on your own.

If you determine that the sender is responsible, then you're experiencing platform abuse (a spammer has found their way onto a legitimate platform and will soon be kicked off). The unsubscribe mechanism is ideal here.

Second, you can report the message as spam. It appears you have a corporate method to do this. They've even told you it's legit, suggesting you unsubscribe. If it's not violation of your employer's rules, you could report the message externally, say to SpamCop and, if you or the sender are in France, Signal Spam.


If the domain name of the link checks out with a reputable company and it has a green SSL padlock you can unsubscribe. Cant get any worse than it is now.

Maybe try opening the unsubscribe link in a Chrome incognito tab in case it is malicious and tries something fishy like CSRF. Or if you are really paranoid, open the unsubscribe in a VM you will throw out afterwards.

  • 1
    Just to mention this, a valid security certificate does not guarantee the validity of a website, especially since it is incredibly easy to get a valid certificate nowadays (Let's Encrypt, etc..). It would be best to search around for any information regarding the website before visiting it.
    – user84120
    Sep 5, 2017 at 8:20
  • 1
    Read: "If the domain name of the link checks out with a reputable company" Kind of covers this?
    – Silver
    Sep 5, 2017 at 8:21
  • 2
    Yeah that's correct, but what if the website has been compromised and the email system is being used to gather active email address for malicious purposes (especially if you start getting subscription emails from a website out of nowhere)? You are correct, but I'm just assuming worst-case scenarios here :P
    – user84120
    Sep 5, 2017 at 8:29
  • Incognito/Private browsing will not help you with all malware. All it does is prevent sites from connecting your private browsing to your regular browsing (yes, this includes most CSRF). A malicious website will still serve you its dangerous content. SSL has nothing to do with any of this and (thanks to efforts like Let's Encrypt) isn't even a barrier for bad actors anymore.
    – Adam Katz
    Nov 2, 2022 at 15:43
  • That's what is covered under "using a VM". An up-to-date browser is very very unlikely to get compromised by a phishing e-mail zero click exploit. People who have zero click browser exploits won't waste them on some broad phishing campaign. These vulnerabilities cost millions on the black market.
    – Silver
    Nov 5, 2023 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .