Yes. The domain name is one of the biggest giveaways that this is a fraudulent email.
Look closely at:
receiveableslinkedin.com
There are several things wrong here.
1. The domain is deliberately constructed to look legitimate
The sender claims to be:
LinkedIn Corporation <[email protected]>
But the domain is not LinkedIn’s domain. LinkedIn’s legitimate corporate domain is linkedin.com.
Instead, they’ve registered or are using:
receiveableslinkedin.com
This is a classic lookalike-domain technique. They have effectively combined two words to make the address appear to be an official LinkedIn accounts-receivable department.
There is also a spelling issue: “receiveables” is incorrect. The correct spelling is “receivables”.
2. The originating server is suspicious
Look at the first line:
Received: from error-no-valid-domain.com (178.211.155.98)
This is particularly interesting.
- The sending hostname is
error-no-valid-domain.com. - The sending IP is
178.211.155.98. - The receiving server is your own Exchange infrastructure,
mail.sircles.net.
The hostname error-no-valid-domain.com is not remotely consistent with a legitimate LinkedIn billing system.
It suggests a poorly configured or deliberately disguised sending infrastructure.
3. Exchange identifies the message as anonymous
These headers are also revealing:
| Header | Value | Meaning |
|---|---|---|
| AuthAs | Anonymous | Not authenticated as an internal Exchange sender |
| AuthSource | Glass.sircles.net | Your Exchange server handled authentication classification |
| AVStamp | 1.0 | Antivirus processing marker |
| Network-Message-Id | Present | Exchange tracking identifier |
Anonymous does not automatically mean malicious, since legitimate external email is also anonymous, but it certainly doesn’t establish LinkedIn’s identity.
4. The Reply-To and Return-Path
Both point to the same suspicious domain:
- Reply-To:
[email protected] - Return-Path:
[email protected]
This means that any response, including a dispute or request for clarification, goes to the suspicious domain rather than LinkedIn.
5. What I would investigate next
There are three particularly useful checks:
- WHOIS: When was
receiveableslinkedin.comregistered? A recently registered domain would strengthen the suspicion considerably. - DNS/MX: Where does the domain send and receive email? Does it have any legitimate relationship with LinkedIn?
- SPF/DKIM/DMARC: Did the message pass authentication for
receiveableslinkedin.com? Even if it did, that only establishes that the sender was authorised to use that domain, not that they represent LinkedIn.
Verdict: Highly suspicious – likely phishing
One important point: I would not simply block the sender’s email address. I would consider blocking the entire receiveableslinkedin.com domain at your Exchange perimeter, subject to checking that it has no legitimate business use.
The most useful additional evidence would be the Authentication-Results and Received-SPF headers, if present. Those would help establish whether the sender has spoofed anything or is operating from a domain they actually control.
Dear Accounts Payable Team,
I hope this message finds you well.
This is our second reminder regarding Invoice #10101520217 for the LinkedIn subscription, which remains unsettled. Despite previous outreach, we have not yet received payment or any update on its status.
Our records also indicate that additional invoices are overdue. We kindly request your immediate clarification on the status of these payments and an expected settlement date. A copy of the LinkedIn invoice is attached for your reference.
To ensure our records remain aligned, we ask that payment be arranged promptly by ACH, o r that you advise us without delay if there are any issues preventing settlement.
We would greatly appreciate your acknowledgment of this message and confirmation of when payment will be issued. Your timely response will help us resolve this matter efficiently.
Thank you for your attention and cooperation.
Sincerely,
Heidi Hafner
LinkedIn Receivables Department
That reinforces the suspicion considerably. I would treat this as a phishing attempt designed to impersonate LinkedIn’s accounts receivable department, rather than a genuine payment reminder.
There are several interesting aspects to the wording.
1. The language is deliberately generic
Notice what is missing:
- No company name identifying the LinkedIn customer.
- No subscription product or service description.
- No subscription period.
- No original invoice date.
- No invoice amount.
- No payment due date.
- No account reference or customer identifier.
It addresses an entirely generic “Accounts Payable Team”.
A genuine supplier chasing an outstanding invoice would normally have sufficient account information to identify the customer and the debt.
2. The ACH reference is particularly interesting
The wording:
“payment be arranged promptly by ACH”
ACH (Automated Clearing House) is predominantly a US payment mechanism.
For a message supposedly concerning a UK business and addressed to [email protected], this is an unusual choice of terminology.
It suggests the message may have originated from a US-oriented invoice collection phishing template.
The spacing in “o r” is another small indication of potentially manipulated or poorly assembled email content.
3. The sender’s identity is manufactured
The sender uses three reinforcing identity elements:
- Display name: LinkedIn Corporation
- Signature: LinkedIn Receivables Department
- Person: Heidi Hafner
But the actual email domain is receiveableslinkedin.com.
This is important because the sender is attempting to establish credibility through repetition of LinkedIn’s name, rather than through an authenticated LinkedIn identity.
4. The invoice attachment is the critical danger
I would be particularly interested in examining the attachment.
It could contain:
- A malicious link to a fake LinkedIn payment portal.
- A QR code directing someone to a fraudulent payment page.
- A fake invoice containing bank account details.
- A malicious Office document or PDF exploiting a vulnerable reader.
- Instructions to pay an account controlled by the fraudster.
Do not open it on an ordinary workstation or follow any links in it.
5. What I would do in your Microsoft 365 / Exchange environment
I’d recommend:
- Quarantine the message and prevent further delivery.
- Search message trace for other emails from
receiveableslinkedin.com. - Search for the originating IP
178.211.155.98. - Check whether other recipients received the same invoice.
- Submit the attachment to Microsoft Defender for analysis, if available.
- Block the domain if confirmed malicious.
One thing I’d particularly like to establish is whether this is a targeted attempt or a mass-distributed invoice scam.
If you upload the invoice attachment here, I can examine its contents, identify suspicious payment details, links, metadata and other indicators of fraud. I would not execute or enable anything contained in it.
