A computer, computer program product, and method identify referrer context information associated with a remote object link. A network inspection module monitors network traffic and a remote object link identification module identifies remote links and their associated referrer context information. A link storage module stores the referrer context information along with the associated link. A look up module looks up the referrer context information in response to a request for a source of a link. The referrer context information is an important security resource in identifying the true source of a threat, and in avoiding future attacks. In addition, it allows for a more complete picture of how a link moves from one client to another by tracking how the link was sent and received.