Fake Microsoft OneDrive / SharePoint shared-document notification sent from a non-Microsoft domain — credential-harvest cross-domain phish; the "view document" CTA leads to a lookalike Microsoft login page. Real OneDrive / SharePoint sharing mail originates from microsoft.com / onedrive.live.com / sharepoint.com only.
onedrive-share-cross-domain
What this tier means
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
How Gorganizer detects this
Fake Microsoft OneDrive / SharePoint shared-document or shared-folder notification sent from a non-Microsoft sending domain (From / Reply-To / link domains do not align with microsoft.com / onedrive.live.com / sharepoint.com / office.com) directing the recipient to a "view document" or "open shared folder" link — credential-harvest cross-domain phish targeting Microsoft 365 tenant credentials. Real OneDrive / SharePoint sharing communications originate exclusively from microsoft.com / onedrive.live.com / *.sharepoint.com tenant subdomains with DMARC-aligned signing; shared-link CTAs always terminate at microsoft.com or *.sharepoint.com, never at third-party domains. OneDrive / SharePoint impersonation is the #1 enterprise file-sharing phishing lure per Microsoft Digital Defense Report 2024 because shared-document notifications are routine in M365 tenants. Distinct from dropbox-share-cross-domain (Dropbox) and googledrive-share-cross-domain (Google) — this targets the OneDrive / SharePoint / shared-with-you / view-document pretext with off-domain href. Detection: OneDrive / SharePoint brand vocabulary + sender or link domain ≠ microsoft.com / onedrive.live.com / sharepoint.com + no DMARC alignment. Trash score: +4. Source: GC1-R32; Microsoft Digital Defense Report 2024; APWG file-share phishing tracker 2025; CISA Microsoft 365 phishing advisory.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started