Suspicious shared link from sender.

[dev1375]

Hi

We receive an email from someone who wants to share some files with us thru dropbox docsend - now he is someone who communicated with us before.

However the dropbox link he sent - which was in tiny url format "https://shorturl.at/"  seems to be directing to a domain: drlve.rnweb.co    and requiring us to enter our Microsoft account to be able to access the files. 

This all looks very suspicious.

However I cannot find anyway to validate this behaviour - hence reaching out to dropbox support/community members.

Anyone have similar experiences - or if can advise if this is a valid behaviour - or this is a confirmed scam.

Thanks

[Megan]

Hey @dev1375, let's jump right into this! 

Can you confirm if the email came from an official Dropbox domain or not? 

It sounds odd that the file would re-direct you to Microsoft, I have to admit. Do you have access to the sender's email, in order to confirm if they've sent you anything? 

Let me know more! 

[dev1375]

Hi megan

so the sender sent us a link to https://docsend.com/view/xxxxxxxxxx  which looks valid ... however when we click on this link ...it opens the docsend portal ...and from there we have a page which asks us to click on a link to access the document ...now that is very weird behaviour.

when we click on the link to  https://docsend.com/view/xxxxxxxxxx   - we would expect to have access to the documents right away.

You can see a snap of what we see when we click on the docsend link below

[Rich · Accepted solution]

---

@dev1375 wrote:

Anyone have similar experiences - or if can advise if this is a valid behaviour - or this is a confirmed scam.

---

This is very much a scam. The drlve.rnweb.co domain and the fake Microsoft sign-in are a phishing attempt. The email you received through Dropbox was likely a legitimate email from the service, but it was being used to send a document intended to scam you.

Forward everything you have to abuse@dropbox.com.

---

We receive an email from someone who wants to share some files with us thru dropbox docsend - now he is someone who communicated with us before.

---

The first thing to do when you're unsure of the legitimacy of such a request is to contact the sender through other means. Do you have his phone or email? Contact him and ask if he sent this to you. I'd bet that he didn't, and that his account was compromised and is being used by a scammer.