Threat Intelligence Directory
Phishing

Fake Dropbox Shared File Notification

Attack Trigger

Trusted file-sharing brand name lowers suspicion before the malicious link is clicked

What Attackers Want

Email or cloud account credentials

How This Attack Works

Fraudulent emails mimic Dropbox file-sharing notifications, claiming someone shared an important document with you. The "View File" button leads to a fake Dropbox or Microsoft login page to steal credentials, or initiates a drive-by malware download.

Red Flags to Watch For

  • Sender is not from @dropbox.com
  • "View File" link does not go to dropbox.com
  • You do not recognize the person who supposedly shared the file
  • The linked page asks for your email password before showing the file

Known Malicious Domains

These domains have been associated with this attack. Never click links going to these addresses.

  • dropbox-file-share.comMALICIOUS
  • dropbox-secure-link.netMALICIOUS
  • dropboxshare-alert.comMALICIOUS

Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.

How Glance Stops This

  • Domain similarity analysis catches lookalike sender addresses at millisecond speed
  • SPF / DKIM / DMARC validation flags authentication failures before you ever see the email
  • VirusTotal + Google Safe Browsing checks every link in real time
  • Urgency language detection scores the email higher for manual review
  • Known malicious domain blocklist updated continuously from live scan data

Don't wait to get hit.

Glance scans every incoming email against 12 detection layers — including the exact tactics described above — before it reaches your inbox.

Protect My Inbox — Free