Every now and then my company gets an email from someone at Shopify (from an actual Shopify email address, sent by mailer3.shopify.com) addressed to a random first initial-last name combination at my domain (not associated with anyone who works or has ever worked at our company).
As a customer of Shopify, I’m rather ticked off that this company I do business with is either buying marketing lists from spammers or generating these email addresses out of thin air, and spamming my domain with them in a manner that closely resembles phishing. I can understand them sending it to my store’s email address, or my email address as an admin on our Shopify store, but to random names of people who don’t exist?!?
Here are 3 examples of emails sent to Steve C at my domain:
2025-07-05 from Samuel Rosales:
-
2026-05-05 from Maxwell Grey
-
Today (2026-08-10) from Hunter Del Valle:
These emails resemble the ones I used to get for Shopify Capital at my own email address before I unsubscribed from those. My domain is set up to route any “catchall” addresses (i.e. any that aren’t specifically configured) to a particular email address that I monitor.
All of the links in the emails are tracking links for mail.shopifysvc.com, and I know better than to click on them. This domain has the same WHOIS information as Shopify.com, suggesting these are legitimate (but unsolicited) emails actually coming from Shopify.
I also had a thread of 3 emails sent to a different random name at my domain in April and May of this year from Maxwell, the first of which I forwarded to phishing@shopify.com but received no reply beyond an automated confirmation of receipt.
Does anyone else get these? Are they real people? If so, what the heck is Shopify doing and where are they getting these emails from?!?