Fake Dropbox shared-document or shared-folder invitation sent from a non-Dropbox domain — credential-harvest cross-domain phish; the "view document" CTA leads to a lookalike Dropbox login page. Real Dropbox sharing mail originates from dropbox.com / dropboxmail.com only.
dropbox-share-cross-domain
What this tier means
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
How Gorganizer detects this
Fake Dropbox shared-document, shared-folder, or "someone shared a file with you" invitation sent from a non-Dropbox sending domain (From / Reply-To / link domains do not align with dropbox.com / dropboxmail.com) directing the recipient to a "view document" or "open shared folder" link — credential-harvest cross-domain phish that abuses the implicit trust of file-sharing notifications. Real Dropbox sharing communications originate exclusively from dropbox.com / dropboxmail.com / no-reply@dropbox.com with DMARC-aligned signing; shared-link CTAs always terminate at dropbox.com, never at third-party domains. Sharing-notification lures are highly effective because clicking a "view document" link feels routine and the credential-prompt that follows looks identical to the real Dropbox login. Distinct from generic file-share-phish — this targets the Dropbox brand / someone-shared-a-file / cross-domain From-link mismatch pretext. Detection: Dropbox brand vocabulary (shared document, shared folder, view document, someone shared with you) + sender or link domain ≠ dropbox.com / dropboxmail.com + no DMARC alignment. Trash score: +4. Source: GC1-R31; APWG Dropbox phishing report 2025; Dropbox anti-phishing guidance; CISA file-sharing impersonation alert.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started