# Phishing sites impersonating Dropbox PhishDestroy has recorded 36 phishing domains impersonating Dropbox since 2025-08-07, 2 of them in the last 30 days. The most used registrars are GoDaddy.com and MarkMonitor; the most common TLDs are .com and .app. The official Dropbox domain is dropbox.com: any other site asking for your login or wallet is not Dropbox. 36Domains, all time 2Last 30 days 19Online at last check 2Confirmed takedowns ## New domains in the last 90 days Dropbox phishing domains detected per day: 12 from 2026-07-25 to 2026-10-22; peak 2. ## How to tell a fake Dropbox site Official domain: dropbox.com. Words most often added to the brand in reported domains: trezor, dropboxx, airdrop, box, airdropboxbet, whastsnapp, portal, pkim, gallezone, xref. - Type the address yourself or use a bookmark; phishing links for Dropbox arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Dropbox will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Dropbox phishing domains The 36 most recently detected domains impersonating Dropbox Domain | First detected | Status at last check | Registrar | [taskerx.800876.xyz](https://phishdestroy.io/domain/taskerx.800876.xyz/) | 2026-10-21 | Offline | Name.com | [scottjdecker.com](https://phishdestroy.io/domain/scottjdecker.com/) | 2026-09-27 | Online | Bluehost | [secure-dropbox.ist](https://phishdestroy.io/domain/secure-dropbox.ist/) | 2026-09-16 | Online | GoDaddy.com | [dropbox-online.net](https://phishdestroy.io/domain/dropbox-online.net/) | 2026-09-10 | Online | GoDaddy.com | [dropbox.rev.it](https://phishdestroy.io/domain/dropbox.rev.it/) | 2026-09-09 | Online | Aruba s.p.a | [dropboxbiz.com](https://phishdestroy.io/domain/dropboxbiz.com/) | 2026-09-08 | Online | GoDaddy.com | [dropbox-online.at](https://phishdestroy.io/domain/dropbox-online.at/) | 2026-09-04 | Online | GoDaddy.com, ( https://nic.at/registrar/ | [cn-drawio.com.cn](https://phishdestroy.io/domain/cn-drawio.com.cn/) | 2026-09-03 | Online | Web Commerce Communications | [38d8cygy7yl5kgvr.dropboxx.us](https://phishdestroy.io/domain/38d8cygy7yl5kgvr.dropboxx.us/) | 2026-08-28 | Online | PublicDomainRegistry.com | [1qx7r7mj78molew3.dropboxx.us](https://phishdestroy.io/domain/1qx7r7mj78molew3.dropboxx.us/) | 2026-08-28 | Online | PublicDomainRegistry.com | [help-treoz-io-web-start.typedream.app](https://phishdestroy.io/domain/help-treoz-io-web-start.typedream.app/) | 2026-08-23 | Online | Typedream | [qwqaqwqasqsaq.edgeone.dev](https://phishdestroy.io/domain/qwqaqwqasqsaq.edgeone.dev/) | 2026-07-31 | Online | Tencent Cloud | [dropgox.lol](https://phishdestroy.io/domain/dropgox.lol/) | 2026-07-23 | Offline | Global Domain | [mvo.org.rw](https://phishdestroy.io/domain/mvo.org.rw/) | 2026-07-09 | Online | THE CLICK | [flodxvlw.com.ng](https://phishdestroy.io/domain/flodxvlw.com.ng/) | 2026-07-06 | Offline | HostAfrica | [zwtld0uxi.com.ng](https://phishdestroy.io/domain/zwtld0uxi.com.ng/) | 2026-07-06 | Offline | HostAfrica | [sw1zzd0kument-anzeig3n0971523.weebly.com](https://phishdestroy.io/domain/sw1zzd0kument-anzeig3n0971523.weebly.com/) | 2026-07-03 | Offline | MarkMonitor | [authv2-dropbox-safelinks-protection-docx.pro](https://phishdestroy.io/domain/authv2-dropbox-safelinks-protection-docx.pro/) | 2026-06-28 | Offline | NICENIC | [dropbox-file-transfer.online](https://phishdestroy.io/domain/dropbox-file-transfer.online/) | 2026-06-15 | Offline | NameSilo | [user-dropbox.com](https://phishdestroy.io/domain/user-dropbox.com/) | 2026-06-13 | Online | Internet Domain Service BS | [helpnets.info](https://phishdestroy.io/domain/helpnets.info/) | 2026-05-08 | Online | Cloudflare | [onstreamz.com.in](https://phishdestroy.io/domain/onstreamz.com.in/) | 2026-04-30 | Online | National Informatics Centre | [view-doc-g5mz.sandyroby1985.workers.dev](https://phishdestroy.io/domain/view-doc-g5mz.sandyroby1985.workers.dev/) | 2026-04-26 | Taken down | Cloudflare | [swqv.pages.dev](https://phishdestroy.io/domain/swqv.pages.dev/) | 2026-03-29 | Online | Cloudflare | [dropboxdash.com](https://phishdestroy.io/domain/dropboxdash.com/) | 2026-03-24 | Online | MarkMonitor | [dropboxenterprise.com](https://phishdestroy.io/domain/dropboxenterprise.com/) | 2026-03-24 | Online | GoDaddy.com | [dropbox-home-page-cloneable.webflow.io](https://phishdestroy.io/domain/dropbox-home-page-cloneable.webflow.io/) | 2026-03-06 | Offline | MarkMonitor | [device-trezor.io](https://phishdestroy.io/domain/device-trezor.io/) | 2026-02-26 | Offline | — | [6981dab3f81073450d7ecd75--reliable-pothos-cdc876.netlify.app](https://phishdestroy.io/domain/6981dab3f81073450d7ecd75--reliable-pothos-cdc876.netlify.app/) | 2026-02-10 | Offline | Name.com, (Netlify) | [trezor.login-main.com](https://phishdestroy.io/domain/trezor.login-main.com/) | 2026-02-07 | Taken down | Metaregistrar | [sigfuisson.ca](https://phishdestroy.io/domain/sigfuisson.ca/) | 2026-01-20 | Offline | NameSilo | [xref-404.co](https://phishdestroy.io/domain/xref-404.co/) | 2025-12-30 | Offline | GoDaddy.com | [portal.pkim.gallezone.lk](https://phishdestroy.io/domain/portal.pkim.gallezone.lk/) | 2025-12-07 | Offline | — | [web.whastsnapp.com](https://phishdestroy.io/domain/web.whastsnapp.com/) | 2025-11-07 | Offline | GKG.NET | [airdropboxbet.live](https://phishdestroy.io/domain/airdropboxbet.live/) | 2025-09-08 | Offline | Web Commerce Communications dba WebNic.c | [airdrop-box.web.app](https://phishdestroy.io/domain/airdrop-box.web.app/) | 2025-08-07 | Online | Google | [All 36 Dropbox reports](https://phishdestroy.io/domain/?brand=Dropbox) ## Where they are registered and hosted ### Registrars - [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)5 - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)3 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)2 - Cloudflare2 - HostAfrica2 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)2 - [Google](https://phishdestroy.io/registrar/google/)1 - [Web Commerce Communications dba WebNic.c](https://phishdestroy.io/registrar/webnic/)1 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)8 - [.app](https://phishdestroy.io/tld/app/)3 - [.dev](https://phishdestroy.io/tld/dev/)3 - [.io](https://phishdestroy.io/tld/io/)2 - [.ng](https://phishdestroy.io/tld/ng/)2 - [.us](https://phishdestroy.io/tld/us/)2 - [.live](https://phishdestroy.io/tld/live/)1 - .lk1 ### Hosting networks - CLOUDFLARENET - Cloudflare, Inc., US6 - Cloudflare, Inc.5 - Host Africa (Pty) Ltd - Host Africa (Pty) Ltd, Z2 - HIVELOCITY, Inc.2 - DEDIK SERVICES LIMITED2 - One Ring Networks, Inc.2 - FASTLY, US1 - CLOUDFLARENET, US1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Dropbox; share of all PhishDestroy reports: 0.02%. Canonical: https://phishdestroy.io/brand/dropbox/