Spurious New Login Notifications

[Peter K.42]

Recently, including this evening, I have received spurious "New Login" email notifications from Dropbox. I believe that the purpose of such notifications is to alert me of possible fraudulent activity and I have no objection to that (the notifications, not the fraudulence).

But I am using the same computer I've had for a year on the same home network I always use. Here is the core of the notification:

We noticed you logged into Dropbox using Safari on Mac OS X from Apex, NC, United States* at 09:06 PM GMT-05:00.

I live in Wisconsin and my WAN IP is assigned dynamically by Time Warner Cable. At the moment my WAN IP is 174.97.187.214 which, upon DNS lookup, is associated with Wisconsin as expected. To be fair, the email notification does say "Location approximated by the IP address of the login." But this is too much of a location discrepancy to dismiss as approximation error.

Any ideas as to what is happening to generate these notifications?

[Marcus O.]

Hi,

to be sure the email isn't an phishing attempt on your password, do not click on links in that email that may require you to login.

Please visit the security tab on your Dropbox Account here:

https://www.dropbox.com/account/security

You may then view your logged in web browsers here and verify the login.
You may also close those browser sessions as well as change your password, or add another login factor to your account security.

Now if the Apex, NC login is shown to be true, you should err on the side of caution and change your passwords as well as unlinking and disconnecting old browser sessions and devices as shown in the security tab.

[Chris K.49]

I got a similar msg this morning.  It took me to the same page as you reference above, with the same data.

So, pretty sure this is coming from dropbox.  The reporting of activity is simply wrong. What is going on?

[Mark]

Are you logging in when it says the log ons occur? 

Its very likely the IP address is being mis-reported due to how your ISP handles its data / caching etc.

[Chris K.49]

Thanks for quick response.

The time stamp for the email is 09:48 -- same as the report of the logon, which does show on the accounts page

Issaquah is about 45 or 50 miles away from me here in Bothell

I certainly did not log on at that time.  I did put a file up a few days ago, and have been working on a shared file recently -- but not today.  No log on there, unless it is automated.

No change in ISP -- no config changes on my end.  Steady state for months, or maybe years..

Note however, the msg (see below) does not include the date.

We noticed you logged into Dropbox using Firefox on Windows 10 from Issaquah, WA, United States* at 09:48 AM GMT-07:00. You can check on this and other login events by visiting your account page. Happy Dropboxing! - The Dropbox Team P.S. Learn how to protect your account.

[tcthegreat]

Interesting, I've had a DB acct for years and I just got the same type of notices in my email. I get worried when I see a foreign country like Albania, because I live in Seattle WA! 

This was the exact email message
"We noticed you logged into Dropbox using Firefox on Windows 7 at 11:58 PM GMT-08:00 from Albania.

Note: Your location may be inaccurate since it was estimated using your IP address. "


I did share a download link yesterday with someone for a file trade, could this be it?
I changed my password to be safe. If anyone has more knowledge on these notices please comment. 🙂