# Have you ever received SPAM on Proton Mail? I just did, and it's annoying **URL:** https://discuss.privacyguides.net/t/have-you-ever-received-spam-on-proton-mail-i-just-did-and-its-annoying/27198 **Category:** Questions **Created:** 2025-05-01T09:50:12Z **Posts:** 43 ## Post 1 by @PurpleDime — 2025-05-01T09:50:12Z I have been a paying **Proton Mail** user for over 5 years and I have never used my default **Proton** address to send mail to anyone other than a **Proton** user years ago. I have also never shared that address with anyone other than a handful of **Proton** users I converted years ago who never use their **Proton** address. I have also never emailed any **Big Tech** email providers with my **Proton** addresses. And I have never used my Proton addresses for any online account other than banking and my password manager. And yet, this week [**I received 2 SPAM emails from Surf Shark VPN**](https://i.postimg.cc/Qdt7mvR1/PROTON-SPAM-SURF-SHARK-VPN.jpg) at my default **Proton** address. I have never used **Surf Shark VPN** in my life. And never considered it as my VPN provider. **How could this have happened?** I have one friend who I know uses **Surf Shark VPN** and she absolutely hates it. She can’t wait to switch. That friend works in IT and is very security conscious. She is also privacy conscious, but less so than me. I am doubtful that that friend is responsible, but I will ask her on Signal. One other possibility is that a **Proton** user, who has a similar username to mine, signed up to **Surf Shark** and made a typo. But how likely is that? **The reason I have avoided sending emails to non Proton users for so long is precisely because I didn’t want to get SPAM. And yet, somehow it happened. I’m really bummed out.** --- ## Post 2 by @anon39279085 — 2025-05-01T09:53:37Z would you be able to further clarify then, because this seems to go beyond what you’re describing honestly… --- ## Post 3 by @PurpleDime — 2025-05-01T09:57:04Z Clarify what? I got spammed by a known company and I don’t know how the spammer got my Proton address because I never use it. --- ## Post 4 by @anon39279085 — 2025-05-01T09:59:30Z Well then it can’t be just “Someone accidentally put my address” that would be _ **too much** _ of a coincidence if you know what I mean. Maybe you used your Proton address somewhere that was in a data breach, I would check on something like for example: [https://haveibeenpwned.com](https://haveibeenpwned.com) It’s nice to try and narrow down I guess… --- ## Post 5 by @PurpleDime — 2025-05-01T10:11:34Z > [@anon39279085](#): > > Maybe you used your Proton address somewhere that was in a data breach, I would check on something like for example: [https://haveibeenpwned.com](https://haveibeenpwned.com) I just checked on [**Have I Been Powned**](https://haveibeenpwned.com). I first entered the **Proton** address I use most of the time to email people, which is not my default address. Nothing. I was not pwned. Then I entered my default **Proton** address. The one I never use for anything, and on which I got spammed. Same results. I was not pwned. This is why this is so strange. I’ve read a lot of testimonies from people who use Proton Mail for everything. They email **Big Tech** email providers like Gmail, and claim to have never been spammed. And somehow, I, someone who uses their Proton addresses very conservatively, I got spammed. --- ## Post 6 by @anon39279085 — 2025-05-01T10:13:40Z Thanks for your clarification I don’t think it’s a bad idea to ask for relatives who used surfshark maybe they used your address by mistake or something, if im seeing correctly of course you mentioned > I have one friend who I know uses **Surf Shark VPN** and she absolutely hates it. She can’t wait to switch. That friend works in IT and is very security conscious. She is also privacy conscious, but less so than me. I am doubtful that that friend is responsible, but I will ask her on Signal. If she did not use your proton address then stuff will get so much stranger and it is possible it could be traced back to surfshark doing something shady? Hard to say without you know… --- ## Post 7 by @PurpleDime — 2025-05-01T10:29:13Z > [@anon39279085](#): > > If she did not use your proton address then stuff will get so much stranger and it is possible it could be traced back to surfshark doing something shady? Hard to say without you know… Yeah. Like I said, I’m doubtful it’s her. We haven’t emailed each other in years. We always communicate via **Signal**. I know that **Nord VPN** , which is owned by the same company as **Surf Shark** , has a loyalty program that rewards you with extra months of service for every person you convert. I have no idea if **Surf Shark** has one too. But to my knowledge, such programs don’t ask for your entire contact list. You have to manually choose them and enter their email address yourself. I don’t think my friend would do this without asking me first. And if it were a situation where the company collects all your contacts and emails them, I would have received an email at my **Gmail** address too, which my friend has. In fact, I don’t think my friend has my **Proton** address because she’s not a **Proton** user. The rare times I’ve emailed her, which was an eternity ago, it was from my **Gmail** address. --- ## Post 8 by @anon99163603 — 2025-05-01T10:50:04Z Most likely smartphones, where apps require one click to access all saved contact information. Also I don’t understand why you worded it like this is such a big deal, or even attempting to trace the leak? Info given to others are not private and you can’t control how people safeguard or use it. It is just what it is. > **[Email Aliasing - Privacy Guides](https://www.privacyguides.org/en/email-aliasing/)** > > An email aliasing service allows you to easily generate a new email address for every website you register for. --- ## Post 9 by @PurpleDime — 2025-05-01T11:20:23Z Why did you link PG’s page on aliases? I use aliases. I have for years. I have 400+ aliases. I use aliases for literally everything except my password manager and my bank. It’s a big deal because: 1. I don’t like SPAM. (Like most people) 2. I went out of my way to avoid SPAM (more than most Proton users). 3. I still got spammed. 4. I can’t trace where the spam came from. --- ## Post 10 by @anon88979181 — 2025-05-01T11:28:27Z All your comments in the thread and the way you’ve written the post reads like it’s the end of the world. Relax. It’s just spam. Yes, no one likes it but it’s easy to block senders and report emails as spam. It happens. All you can do is have great opsec. But the account holder is not the only reason always that one gets spam. It could be any number of factors. You may keep thinking what it is but it won’t change anything now. Best you can do is keep maintaining good opsec and be careful whom you share your email address with. --- ## Post 11 by @shadowwwind — 2025-05-01T11:51:46Z Was it a legit marketing email from Surfshark? Is the domain owned by them? You can ask them where they got it from, I believe under some jurisdictions privacy laws like GDPR they have to tell you. To answer the question in the title, I only recive spam through my linked old gmail address which was in two breaches. --- ## Post 12 by @PurpleDime — 2025-05-01T12:10:11Z I thought I had great opsec. That’s the point. If you receive SPAM at an email address you’ve never used or shared, that’s weird. Also, I look at my Gmail, and I still get a ton of spam there, despite 95% of the emails there being sent to aliases and not my actual address. --- ## Post 13 by @PurpleDime — 2025-05-01T12:14:13Z > [@shadowwwind](#): > > Was it a legit marketing email from Surfshark? Is the domain owned by them? > You can ask them where they got it from, I believe under some jurisdictions privacy laws like GDPR they have to tell you. I just checked. It’s from **Surf Shark** ’s real domain: **[info@mail.surfshark.com](mailto:info@mail.surfshark.com)** Also, according to **Proton Mail** the message is from a mailing list. I will try to reach out to **Surf Shark** , and will reach out to **Proton** too. --- ## Post 14 by @Eebzter — 2025-05-01T12:18:01Z I understand you feel violated by this and that is understandable after putting in effort to ensure this never happens. There could be the possibility that your email was detected as a valid proton address and ended up being sold to surfshark through a marketing list. This is a common occurrence and surfshark probably has no idea who you are and sent it out to the list it purchased. These marketing lists are not always procured with integrity and you happened to be on it. On a side note, it is curious HOW this could have even appeared on a liat such as this. Accidentally connected to the same instance as your gmail? Used a public wifi to connect to your proton mail. Maybe even an extension leak. I am no expert here but there is always the possibility of a “slip” of this information even from your bank. --- ## Post 15 by @PurpleDime — 2025-05-01T12:41:27Z I hear you. I use the **Proton Mail** ’s apps on both desktop and mobile. And all my devices are connected to a VPN 24/7. I also read on Wikipedia that **Surf Shark** is described as a cybersecurity company, and I would assume that they perceive themselves as such. To me, it would be unethical for a cybersecurity company to acquire the email addresses of random people just for marketing. But of course, we know cybersecurity companies are not created equal. Even so, it’s icky to me that a security company would do that. I am sure that the emails _[harrypotter@pm.me](mailto:harrypotter@pm.me)_ or _[harry@pm.me](mailto:harry@pm.me)_ are taken. Yet I wonder if those addresses receive spam simply because they are common usernames that are guaranteed to have an owner. --- ## Post 16 by @Eebzter — 2025-05-01T12:48:48Z Yes it is another possibility the email happened to be a good guess. Did you also analyze the headers to verify the message wasn’t spoofed? --- ## Post 17 by @PurpleDime — 2025-05-01T14:42:30Z Yeah. The message wasn’t spoofed. It’s really from **Surf Shark**. --- ## Post 18 by @anon88979181 — 2025-05-01T14:51:46Z You need to pull on the ejection to stop spiraling through this tizzy. :face_with_peeking_eye: --- ## Post 19 by @any1 — 2025-05-01T21:06:15Z > [@PurpleDime](#): > > I will try to reach out to **Surf Shark** , and will reach out to **Proton** too. Please keep us updated if you get a response --- ## Post 20 by @PrivateDuck — 2025-05-02T04:11:06Z I don’t appreciate how you are brushing off OP’s very valid concerns. He went through great lengths to keep his main email quarantined / isolated and now that has been violated by some spam company. YOU do not get to dictate other people’s threat models or how they react to things that violate their privacy. Everyone has their own frameworks. Please respect his. This is actually a very important post and I am very glad OP shared this because I was also under the impression that my main proton email was isolated as I solely use aliases. Now that OP shared this I can assess my current model and plan accordingly. --- ## Post 21 by @username0990 — 2025-05-02T07:28:38Z I would guess that this is not spam, from your story, from the screenshot you shared, and from a few weird things that have happened to me in the past. Unless your e-mail is unique, with random characters, someone else must have typed your e-mail into the VPN provider’s purchase page. The provider may have saved that e-mail in their database before completing the purchase, without sending any verification code or link to your e-mail, i.e. without checking that the e-mail is valid or that it actually belongs to the person who is going to buy it. So you may now be a registered customer of that service, try resetting your password and if there is indeed an account that someone has created using your email, deactivate it. I would receive many mails that an e-mail address I used in the past was used by other people on various e-commerce sites. I saw a lot of receipts belonging to other people. I even once saw a person set my e-mail as the recovery e-mail for another account. :upside_down_face: The human creature has members who exhibit very bizarre behavior. --- ## Post 22 by @cuyholc6857 — 2025-05-02T07:53:50Z I agree with what you’re saying. Someone probably just typed in a random email address and happened to enter someone else’s real one by chance. Primary email address should be memorable, yet complex. --- ## Post 23 by @donutfreak — 2025-05-02T16:21:55Z You may want to rethink your email and see how you can protect your inbox. Similar to [hey.com](http://hey.com)’s contact access. Email is kind of broken in that anyone can email anyone. --- ## Post 24 by @PurpleDime — 2025-05-05T15:06:30Z Thank you for coming to my defense. I appreciate it! :blush: --- ## Post 25 by @PurpleDime — 2025-05-05T15:14:22Z > [@any1](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/purpledime/48/4885_2.png) PurpleDime: > > > I will try to reach out to **Surf Shark** , and will reach out to **Proton** too. > > Please keep us updated if you get a response I reached out to **Surf Shark** , **Proton** , and my one friend who I know uses **Surf Shark**. I haven’t heard back from my friend or **Proton** yet. I did hear back from **Surf Shark**. Their customer service is awful, because every time it’s a different agent who replies to my email. IMHO, it’s better if the same agent who is assigned a ticket to stay on that ticket. Only if a significant amount of time passes should it go o someone else. Anyway, **so far Surf Shark has provided no answer.** Each agent kept telling me that I must have subscribed to their service, when my original email and replies specifically clarified that I hadn’t. There is one thing that I haven’t done, though, and I would appreciate your advice on this. I emailed **Surf Shark** from an alias and shared the screenshots I shared with you with them. I did not share my **Proton** email with them, ie the **Proton** email to which the spam was sent. Should I? Right now, I am reluctant to do so for fear of receiving more SPAM from them. --- ## Post 26 by @Eebzter — 2025-05-05T15:29:24Z If you never share it, then I still wouldn’t. Unless it is haunting you to the point where it needs to be known thus forcing you to actually send them the email you don’t want them having in the first place. --- ## Post 27 by @PrivateDuck — 2025-05-05T15:55:59Z This is definitely off topic / side convo but someone posted this article on twitter the other day and it had thousands of likes: > **[Disturbing facts about ProtonMail](https://encryp.ch/blog/disturbing-facts-about-protonmail/)** > > Some disturbing facts and my personal experience with Proton AG Obviously take it with a grain of salt but might be good information to know given your interest with proton… --- ## Post 28 by @any1 — 2025-05-05T16:15:00Z > [@PurpleDime](#): > > I did not share my **Proton** email with them, ie the **Proton** email to which the spam was sent. They technically already have it stored somewhere; you could share it with them, and if you start receiving more spam and haven’t gotten any satisfying answers from either Proton or Surfshark, delete the alias. --- ## Post 29 by @Shampoo — 2025-05-05T17:20:31Z Oh god not this article again. If it’s the one I’m thinking of it’s written by a guy that had a conspiracy that the 5$ in monthly donations privacy [tools.io](http://tools.io) received was a bribe from proton. --- ## Post 30 by @yes — 2025-05-06T14:55:22Z > [Disturbing facts about ProtonMail](https://encryp.ch/blog/disturbing-facts-about-protonmail/) This article is pure [FUD](https://www.reddit.com/r/ProtonMail/s/7GrYtarE95). --- ## Post 31 by @ImTooPhaT — 2025-05-06T15:12:18Z I’ve only been using Proton Mail for about ~8 months and have not received any spam emails (yet). I have created aliases for this reason. To me, a spam email is a suspicious email from a suspicious address with a suspicious link. Surfshark is a reputable company, and based on your screenshot, it looks like one is a marketing e-mail and the other is a registration email to complete your purchase. Unless payment was made under your name using your bank account, I wouldn’t worry about the email. You can contact Surfshark to remove you from their mailing list and you should not receive any more emails from Surfshark. --- ## Post 32 by @PurpleDime — 2025-05-06T15:36:17Z > [@ImTooPhaT](#): > > To me, a spam email is a suspicious email from a suspicious address with a suspicious link. I hear you. And it used to be my understanding of SPAM too, but the definition is wider. In very simple terms, SPAM is any undesirable email. If a friend repeatedly emails you to promote his business products to you, that’s spamming. Especially when you didn’t ask to receive those emails, and you demanded they stop. > [@ImTooPhaT](#): > > Surfshark is a reputable company, I don’t know about that, but reputable companies can SPAM too. Not long ago, I exchanged a product from a very big and reputable store in my city, because the model I bought was faulty. The store I bought it from needed an email address, so I created an alias just for them. After that I got constant promotional emails multiple times a week. That’s SPAM. Similarly, a while back I had my computer repaired at a very reputable repair store. They needed an email, and I gave them an alias. The staff was super nice and provided good customer service. I was still bombarded with promotional email multiple times a week. That’s SPAM too. In both cases, I got so much SPAM that I had to disable my aliases for those companies. It was the first time I ever disabled an alias. > [@ImTooPhaT](#): > > You can contact Surfshark to remove you from their mailing list and you should not receive any more emails from Surfshark. I have contacted them, and I am waiting to hear back. In general, I do no trust companies to stop emailing me when I ask them to. Too many times I’ve unsubscribed and still got emails months or years later. One example that comes to mind was with is a very popular European Airline. --- ## Post 33 by @username0990 — 2025-05-06T15:47:55Z Maybe you can contact the [founder](https://www.linkedin.com/in/vytautas-kaziukonis-95aa201ab/) of the company directly. --- ## Post 34 by @PurpleDime — 2025-05-06T16:03:19Z lol No. I doubt it would even be effective. That said, it’s interesting to me that he defines his company as a privacy protecting company, meaning that that is their core priority. As I’ve said it before, to me, a company the purports to be primarily about protecting privacy, is seriously invested in privacy rights. They’re fighting the good fight with other freedom fighters, and are not in it just for the money, i.e. because there is a market for privacy products and services. Based on Surf Shark’s Twitter, page, I am not getting that impression from their company. And to my knowledge, they have never been promoted in the privacy community. --- ## Post 35 by @ImTooPhaT — 2025-05-06T16:20:21Z The difference is the amount of control you have over the “undesirable” emails. If you demand your friend to stop sending you spam, but they continue to do so, you can just block their e-mail. If you block e-mails from Surfshark, you shouldn’t receive any more e-mails from them. But if it’s a suspicious e-mail (typically located in your junk folder), then blocking those e-mails is usually pointless because there are plenty of them that are all sending the same spam e-mails. When I say “reputable”, I mean companies that are well-known and used by many, which is unrelated to privacy. And yes, marketing e-mails are typical. When I ordered a pizza from Dominos, I gave them one of my alias addresses, not knowing they would send me marketing e-mails. Proton will not block those e-mails because they are not considered spam. Maybe you want those e-mails because you voluntarily opted to receive those e-mails. But even if you didn’t, you can always opt out, which is a lot better than Proton filtering out marketing e-mails because the wrong e-mails can be caught in their spam filter. In both of your cases, it sounds like you could have opted out from receiving marketing e-mails instead of disabling your alias. So far, I have not received any further e-mails from Dominos. --- ## Post 36 by @PurpleDime — 2025-05-06T16:52:53Z > [@ImTooPhaT](#): > > The difference is the amount of control you have over the “undesirable” emails. True. But it’s very common for people to change their minds about emails the once desired. For example, I remember a marketer saying that when Groupon started out, people were not bothered by the emails. But after a while, maybe a couple of years, it started to feel like SPAM, even though the amount of emails might have not increased. > [@ImTooPhaT](#): > > When I say “reputable”, I mean companies that are well-known and used by many, which is unrelated to privacy. I understand. > [@ImTooPhaT](#): > > In both of your cases, it sounds like you could have opted out from receiving marketing e-mails instead of disabling your alias. I probably could have, but simply disabling my aliases for those shops was easier and felt more empowering. And like I said before, I have experienced the websites not respecting the fact that I unsubscribed. With aliases, it’s just easier to reject them. I don’t have to explain myself. **Out of curiosity, do you email Big Tech addresses with your Proton emails (Gmail, Yahoo, Hotmail, AOL, etc…)?** --- ## Post 37 by @PrivateDuck — 2025-05-06T18:15:18Z > [@yes](#): > > This article is pure FUD. Care to elaborate? Which part is FUD? Author provided a lot of evidence but yeah most of it could be paranoia which is still good to read and form your own opinions --- ## Post 38 by @yes — 2025-05-06T20:15:09Z > **[Reddit - The heart of the internet](https://www.reddit.com/r/ProtonMail/comments/14demhj/debunking_proton_and_ciansa_fake_news/?share_id=BUpbeGijBwtI33ofr-Jbr)** Should have posted this in my first reply though, sorry about that. --- ## Post 39 by @PurpleDime — 2025-05-14T14:59:00Z **UPDATE! :slightly_smiling_face:** **SURF SHARK:** I finally got a proper answer from **Surf Shark**. They confirmed that my **Proton** email was linked to a recently created account. They don’t know how this happened, and kept insisting that I must have subscribed to their service, when I repeatedly told them from the very beginning that I hadn’t. **They said that they could have my address completely deleted from their system and offered me 2 options:** 1. They do it themselves, but I have to send an email from my **Proton** address to confirm I am the owner. 2. I do it myself, but it first requires completing the creation of the account linked to my address by creating a password for it. I chose the former. I sent 2 emails. I sent a password-protected email from my **Proton** address to confirm my identity. And I sent an email from the alias I’d been using to correspond with Surf Shark this whole time, with the password. I insisted in both emails that they do not reply to my **Proton** address and only to my alias, but guess what? I still got a reply at both addresses, and I also got an additional email to my **Proton** address asking me to rate their service. :upside_down_face: **They confirmed my email was deleted from their system, and I hope I never hear from them again.** **PROTON:** There is nothing they can do. All they did was confirm **Surf Shark** ’s address is legit, based on the screenshots I sent them. They offered to verify if my Proton address has been compromised, but I declined. I don’t even know how they could do that. **MY FRIEND:** I have yet to hear back from my friend who uses **Surf Shark VPN**. --- ## Post 40 by @any1 — 2025-05-14T18:44:27Z > [@PurpleDime](#): > > recently created account Thanks for the update. If someone created an account using your email, shouldn’t you have received a verification email? Or was the verification included in the first email shown in the screenshot from your first post? --- ## Post 41 by @PurpleDime — 2025-05-15T07:30:54Z > [@any1](#): > > Thanks for the update. If someone created an account using your email, shouldn’t you have received a verification email? Or was the verification included in the first email shown in the screenshot from your first post? The emails I got were emails asking me to confirm a purchase. For some websites, signing up is a multistep process, in that your account is not fully created until you confirm your email and create a password. My guess is that is the case for Surf Shark. Who ever entered my email had to confirm a purchase, but since they entered the wrong address, they couldn’t. --- ## Post 42 by @ledger — 2025-05-16T10:04:59Z Is it possible that this is because of a non FOSS keyboard like GBoard? From what I have read, the keyboard can log strokes, mostly for advertising purposes in data collection, and sell them after piecing together various aspects of the identity they associate through bits and pieces of your interactions with their software. Please correct me if I am wrong. --- ## Post 43 by @PurpleDime — 2025-05-16T12:11:40Z > [@ledger](#): > > Is it possible that this is because of a non FOSS keyboard like GBoard? That is a very far-fetched and highly unlikely theory, IMO. But yes, the dangers of using **GBoard** are real. That’s why I stopped using **GBoard** years ago. The keyboard app I use is **AnySoft Keyboard** , which is open sourced.