Child Item

I've received a suspicious shared link from sender, that re-directs to a weird domain.

We receive an email from someone who wants to share some files with us thru dropbox docsend - now he is someone who communicated with us before.

However the dropbox link he sent - which was in tiny url format "https://shorturl.at/" seems to be directing to a domain: drlve.rnweb.co and requiring us to enter our Microsoft account to be able to access the files.

This all looks very suspicious.

However I cannot find anyway to validate this behaviour - hence reaching out to dropbox support/community members.

Anyone have similar experiences - or if can advise if this is a valid behaviour - or this is a confirmed scam.

Thanks

Find more posts tagged with

Security

Disagree

Accepted answers

Rich

@dev1375 wrote:
Anyone have similar experiences - or if can advise if this is a valid behaviour - or this is a confirmed scam.

This is very much a scam. The drlve.rnweb.co domain and the fake Microsoft sign-in are a phishing attempt. The email you received through Dropbox was likely a legitimate email from the service, but it was being used to send a document intended to scam you.

Forward everything you have to abuse@dropbox.com.

We receive an email from someone who wants to share some files with us thru dropbox docsend - now he is someone who communicated with us before.

The first thing to do when you're unsure of the legitimacy of such a request is to contact the sender through other means. Do you have his phone or email? Contact him and ask if he sent this to you. I'd bet that he didn't, and that his account was compromised and is being used by a scammer.

All comments

Megan

Hey @dev1375, let's jump right into this!

Can you confirm if the email came from an official Dropbox domain or not?

It sounds odd that the file would re-direct you to Microsoft, I have to admit. Do you have access to the sender's email, in order to confirm if they've sent you anything?

Let me know more!

dev1375

Hi megan

so the sender sent us a link to https://docsend.com/view/xxxxxxxxxx which looks valid ... however when we click on this link ...it opens the docsend portal ...and from there we have a page which asks us to click on a link to access the document ...now that is very weird behaviour.

when we click on the link to https://docsend.com/view/xxxxxxxxxx - we would expect to have access to the documents right away.

You can see a snap of what we see when we click on the docsend link below

Rich

@dev1375 wrote:
Anyone have similar experiences - or if can advise if this is a valid behaviour - or this is a confirmed scam.

Forward everything you have to abuse@dropbox.com.

We receive an email from someone who wants to share some files with us thru dropbox docsend - now he is someone who communicated with us before.