I get a steady stream of phishing emails but this one is really weird. I keep getting an email that appears extremely legitimate from Linkedin. I knew something was wrong with it however because it came to an address I do not use for Linkedin and moreover the person who was supposedly requesting the connection says she never sent it, so it would appear to be a forgery. The email address was known to my counterparty, so it is possible her computer is hacked and they vacuumed her email address book to get my address.

The only problem is that the clickable link in the email does appear to go to Linkedin. Here is the link (edited slight to invalidate the tokens):


Since this link does appear to be going to Linkedin (not the usual Russian proxy), how can the phisher possibly be using it?

  • Is this question's discussion relatable to yours: security.stackexchange.com/questions/122496/… ?
    – Limit
    Dec 8, 2016 at 4:06
  • @Limit That is interesting, but the other question involves an slink parameter, which is apparently a type of LinkedIn redirect. In my case, it does not appear to be a redirect. Dec 8, 2016 at 4:25
  • true. I noticed lots of LinkedIn spams being some variant of slink problem so wondered if this would help you.
    – Limit
    Dec 8, 2016 at 7:02

1 Answer 1


If you have verified that this email actually comes from LinkedIn, then the spoofing is likely on the other side: somebody pretending to be your friend wanted to connect to you, possibly to better impersonate that friend or to otherwise traverse their (or your) professional networks.

From there, they can launch a more sophisticated attack (think APT or BEC).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .