When you land on a URL like email.hrmorning.com, it's natural to wonder if it's safe or a scam. The short answer: this isn't a typical website you can browse. It's a subdomain likely used by HR Morning (a known HR publication) to send and track email campaigns through Mailgun. The invalid SSL certificate — it's issued for mailgun.org, not for this subdomain — and the 404 page you see mean this address isn't meant for direct web access. That doesn't make it malicious, but it does mean you shouldn't expect to find a login form, a landing page, or any content here. If you were directed to this URL by an email link, it's probably a tracking pixel or a bounce handler, not a destination you need to trust with personal information. For a legitimate email marketing setup, the main domain (hrmorning.com) is where you'd look for contact info, privacy policies, and company details. This subdomain alone offers no reassurance, so treat it as a tool, not a site.
No — email.hrmorning.com doesn't look safe
In plain English
This isn't a normal website — it's a subdomain set up for email delivery through Mailgun, and it's not meant to be visited. The invalid SSL certificate and 404 page show that clicking a link to this address will likely lead nowhere useful. If you were expecting a working site or a login page, something is off. I'd treat it as a dead end and avoid relying on it for anything beyond email handling.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The SSL certificate is invalid for this domain — it's issued for mailgun.org, not for email.hrmorning.com. Combined with the site being unreachable and returning a 404, this is a clear sign that the site is not meant to be visited directly. No malware flags from Google, but the security posture is poor for a public-facing endpoint.
The subdomain doesn't appear in WHOIS, which is normal for subdomains. The parent domain hrmorning.com likely belongs to a known HR publication, but we can't verify ownership here. No hidden ownership red flags, but also no clear confirmation of who runs this specific subdomain.
Not on any blacklists and no malware history, but the domain has no presence in the Wayback Machine and is not ranked in the top million. This is consistent with a very new or transient subdomain used for email delivery. The lack of a web history offers no reassurance.
No about page, contact info, or social media links. For a subdomain that isn't intended to be a public website, this is technically expected, but it still means anyone visiting the URL gets zero information about who runs it or why it exists.
No privacy policy or terms of service, but this subdomain likely isn't a commercial site collecting data. For an email marketing endpoint, legal pages would be hosted on the main domain. The absence here is not a compliance red flag, just neutral.
DNS is clean, email authentication is set up via Mailgun, and the site loads fast from Google Cloud. However, the SSL mismatch and the fact that the site returns a 404 indicate the infrastructure is misconfigured for web browsing — it's meant for email handling, not public access.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.