https://www.f-droid.org/en/packages/com.trianguloy.urlchecker/

Use this so you might be able to figure out if it is a bad link yourself.

It’s possible, I’ve been tricked last year by a similar attack (the sneakiest attack possible to target privacy people, imho).

I praise IT Security for putting so many safeguards, sandboxes and verifications!

Yes, there is no way to limit the links put in an email by someone else.

It is a dumb stratergy though, as email filters are getting better all the time, so the recipient’s filter will catch on quickly.

To explain further, part of my duties at work as an IT technician is to investigate emails getting caught in the email filter or emails that are reported as bad.

The filter will analyze links, attachments, sender and the general contents of the email, and if it finds something bad, it will block it and inform IT.

We then use a fairly large toolset to investigate the email, we see a lot of metadata, in addition to the email itself.

We also see a quick summary of why the email was blocked, and can look through all incomming mail, even those delivered, to find more from the same campaign and then delete them.

So swapping an ubsubscribe link is no isdue at all for an attacker, but all links en emails are scanned, so if you do do that, it will be discovered very quickly.

As an addendum to my write up on my work with email scanning and the access we have at IT, I allway want to add some context, and I feel this is extra important in a privacy focused community:

This is only dealing with work emails, we do not have access to your external email.

We at my IT team are just interested in getting rid of bad emails from our system, while we have the access none of us are interested in gossip, we go in, investigate the issue, do what we have to to clean it up, and then leave.

That is what our coworkers/employer can trust us on, but as the saying goes, “trust and verify”, there are a lot of logs that log our actions that will show exactly what we did in the system and when.

Gossip and playing office politics is not interesting, they are directly opposed to our work, and I am lazy, I don’t have the time or energy to deal with that.

It’s possible to let them know the email is active, and they should follow up.

Yes as its just another link, but not that usable deployed alone.

For example, log in to unsubscribe. I had a few marketing emails does this.

However, when’s your last time clicking the unsubscribe link? I guess most people would mark it spam before unsubscribe, at least I do.

Most attackers will consider more eye catching, urgent, and time sensitive subjects like prizes win, exclusive discounts, or account security warning rather wait one clicking on the unsubscribe link. It is more resonable to add a malicious unsub link with all other links. Actually, all links should redirect the victim to the phishing page.

If you are worried about malicious links, try this: https://www.browserling.com/
It’s free :D
An alternative is also https://hyperbeam.com/ which allows you to open a virtual browser. 😜