Link: Direct link to Dropbox Paper file

calendar Aug 17, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects inbound messages containing links to Dropbox Paper documents using the /scl/fi/ sharing path with a .paper file extension and an rlkey query parameter. This pattern is commonly abused to host phishing content or malicious redirects behind Dropbox's trusted domain, allowing messages to bypass reputation-based filtering while luring recipients into opening a shared document.

Sublime rule (View on GitHub)

 1name: "Link: Direct link to Dropbox Paper file"
 2description: "Detects inbound messages containing links to Dropbox Paper documents using the /scl/fi/ sharing path with a .paper file extension and an rlkey query parameter. This pattern is commonly abused to host phishing content or malicious redirects behind Dropbox's trusted domain, allowing messages to bypass reputation-based filtering while luring recipients into opening a shared document."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.root_domain == "dropbox.com"
 9          and strings.istarts_with(.href_url.path, '/scl/fi/')
10          and strings.iends_with(.href_url.path, '.paper')
11          and 'rlkey' in keys(.href_url.query_params_decoded)
12  )
13    
14tags:
15  - "Attack surface reduction"
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Free file host"
20  - "Social engineering"
21  - "Out of band pivot"
22detection_methods:
23  - "URL analysis"
24id: "0871677f-8dae-5cfc-8287-51a7b8bf3bc9"

Related rules

to-top