I've been getting emails at my work address for the past year from a company I don't remember subscribing to (especially not with my work email address). I've reported it as spam, but got a reply from my company saying it's a real company.

I'm dubious, and I've read that you shouldn't click unsubscribe from emails you don't remember subscribing to as it alerts spammers that it's a live address, so I set up a filter to auto-delete the emails.

However, the emails keep changing. The email address in the from field changes, or the name of the company changes slightly, etc. Eventually, new emails slip through, and I have to set up a new filter. Also, the URL in the unsubscribe link changes with every email. The email itself always contains a link to a document to read about the latest technology updates in (my field), but the URL always ends in ?email=(my email address)?from=(number). (At least I assume it's a document, I've never clicked on one.)

I feel like a reputable company wouldn't do something like this, and so I'm still hesitant to unsubscribe. The people the emails are from seem to have LinkedIn profiles, but I've also found some other posts suggesting it might be spam.


Am I being over-paranoid? Should I just unsubscribe?

In a more general case, what things can I do to work out if an email is safe to unsubscribe from?


If the domain name of the link checks out with a reputable company and it has a green SSL padlock you can unsubscribe. Cant get any worse than it is now.

Maybe try opening the unsubscribe link in a Chrome incognito tab in case it is malicious and tries something fishy like CSRF. Or if you are really paranoid, open the unsubscribe in a VM you will throw out afterwards.

  • 1
    Just to mention this, a valid security certificate does not guarantee the validity of a website, especially since it is incredibly easy to get a valid certificate nowadays (Let's Encrypt, etc..). It would be best to search around for any information regarding the website before visiting it. Sep 5 '17 at 8:20
  • Read: "If the domain name of the link checks out with a reputable company" Kind of covers this?
    – Silver
    Sep 5 '17 at 8:21
  • 2
    Yeah that's correct, but what if the website has been compromised and the email system is being used to gather active email address for malicious purposes (especially if you start getting subscription emails from a website out of nowhere)? You are correct, but I'm just assuming worst-case scenarios here :P Sep 5 '17 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.