How are spammers using LinkedIn "http://linkedin.com/slink?code=..." URLs?

Question

I was sent this kind of link from presumably compromised Skype account, via a skype message (do not click unless you have a sandbox or something to protect you):

https://www.linkedin.com/slink?code=e4ig_yU#56287=myskypeusername

Where the myskypeusername is, well yes, my skype user name.

Clicking that, the URL would take you through a series of redirects and finally to a page selling some "miracle Brain IQ pills" claiming to boost, double, whatever one's mental capabilities... so clearly SPAM.

Does anyone know what the /slink... etc. URLs are used by LinkedIn? Google brought up nothing, except a few other cases where LinkedIn has been used to redirect users to SPAM.

I contacted LinkedIn about this and their "Safety support specialist" basically said they cannot do anything about it given it's not a message sent by linkedin user... go figure.

UPDATE: After I reiterated the problem to LinkedIn support, I got back the following:

Thank you for your response. We will look into this issue further and take necessary action based on our results. Thanks for your assistance in keeping LinkedIn a professional and trustworthy site.

Hopefully that's more than just words; we'll see I guess.

Answer 1

So I just stumbled upon this today and got a similar message:

https://www.linkedin.com/slink?code=eiurEkp?61778=myname

First I tried the first part: https://www.linkedin.com/slink?code=eiurEkp

This ends here: http://281-inteligen.thiscontentedmotion.com/de/ihel/inteligen/ - a scammy article about somebody saying that someone said that this pill will just change the whole world...... But well, it looks like a normal news-paper website and the source-code actually looks semantically clean.

So if linkedin might check the destination's source-code it would be okay in this case and to this point.

But when entering: https://www.linkedin.com/slink?code=eiurEkp?61778 (with the second search-param) - it seems by reading over there obfuscated JavaScripts, that they check for search/hash-params in the URL and redirect properly if found.

And this is probably not being checked by the linkedin-team. I mean how should they? This is hard because it is happening in an obfuscated JS. If they have some automated slink-checker they are scanning the code but likely don't execute the scripts.

---

Long story short: The slink?code=####### part redirects to a shared link from linkedin and appends any given hash or search parameter to this redirect. On the redirected destination this is then checked and used for a further redirect.

Answer 2

Well, just by testing /slink?code=0 (a 404 error) and /slink?code=1 (LinkedIn Business Marketing Solutions), I'm guessing it's reserved for customers of LinkedIn Business Solutions.

That said, I don't think it's that frequently used. I don't see much email traffic using it (I see more traffic using Hashcash, which is extraordinarily obscure.) This type of link represents 0.03% of the email traffic linking to the www.linkedin.com CDN. This redirector is so infrequently used that I cannot determine how spammy it is.

To answer the question of how spammers are abusing this: Presumably, a spammer registers a phony account at LinkedIn and then uses this redirection service just like any other. It's a bit risky since LinkedIn is no stranger to resolving abuse (e.g. they're a key backer of DMARC) and there are so many other redirection services out there, but perhaps there's some illusion of legitimacy to using this instead.

A direct posing of this question to LinkedIn resulted in Franck Martin (one of their key DMARC advocates) saying:

This email was not sent by Linkedin.
Linkedin uses several lists to ensure the redirection does not end up to a known bad site. In all cases, please report it to abuse [at] linkedin (as well as the major URL anti-phishing lists) and we will take the appropriate actions.

(As noted in this thread on the SpamAssassin Users mailing list.)

Note that just because the specific sample that Franck saw wasn't sent by LinkedIn doesn't mean that there isn't any abuse of this shortener, but I do trust that they police it well. There's merely little they can do to control the emails they're not in control of (unless the email forges sending from @linkedin.com because it is protected by a DMARC p=reject policy. This policy instructs recipients to reject policy violations).

If you report the message to them, they should at least be able to break the redirector, which is the case for this link (as noted in another answer to this question). If their infrastructure did send the mail, they can chase it down further and take action against the customer.

Answer 3

It looks like your link is dead as it now redirects to https://www.linkedin.com/static?key=incomplete_request_error

I'm not sure if there is a builtin mechanism that would specifically support user redirects in linkedin, but if the spammer injected HTML, they may have used meta tags to accomplish this.

e.g.

<meta http-equiv="refresh" content="5;URL=target_link_here">