When a user Shares a Link using Egnyte, they can opt to receive an email notification when the link is accessed. In some situations, this notification arrives before the intended recipient has opened the link. This is not a security issue. The common scenarios are described below.
Automated Pre-validation by Third-party Systems
Public shared links may be pre-validated by third-party automated systems, which triggers a notification before the recipient has clicked the link. This applies only to links shared with Anyone (Public link accessible to anyone) level access.
These notifications may show an unknown IP address or location. They can be triggered by email services (for example, Gmail, Outlook), social networks (for example, Facebook, X), messaging apps (for example, Teams, Slack), and mail client integrations such as anti-virus software used by the link creator or the recipient.
Access by the Link Creator
A notification is sent for every access of a link, including access by the link creator. If the link creator opens the link after creating it, a notification is generated even if the link has not yet been shared. The IP address in the notification will match the link creator’s own IP address. This also applies to password-protected links; entering the password does not suppress the notification.
Generic Wording for Links Without Recipients
If a link was created without specific recipients (for example, Anyone or Anyone with password), the notification uses generic wording such as “The recipient has accessed the folder”. This does not indicate access by an unknown person. The wording is used because the link has no named recipient.
Location Shown in the Notification
The location in the notification is estimated from the IP address and is approximate. It may show a different city, region, or country than the actual access location. When verifying an access, rely on the IP address rather than the displayed location name.
Prevention
- To prevent third-party automated systems from accessing a link, share it with a password (Anyone with password access level). Automated systems cannot access the link without the password. A password does not prevent notifications for genuine accesses, including access by the link creator.
-
Enable Verification for Public Links. Recipients must verify their email address with a one-time code before accessing the link, which automated systems cannot complete.
Verification for public links feature is available for the New Generation Platform plans only. Contact the Egnyte account manager or Egnyte Sales team for more information
Contact Egnyte Support for any additional questions or assistance.