Excerpt from this article:
You can see the real link under the “Verify my email” button in a few ways, like viewing the message in plain text (instead of the HTML commonly used to display links and graphics in email) in your desktop mail program. On a mobile device, press and hold the button or link — but do not tap it as you normally would — to reveal the hidden address. You can report the phishing messages by forwarding them to firstname.lastname@example.org.
Dropbox users have been frequent targets of scammers. The company’s support site has a guide to recognizing malware and phishing attempts, as well as instructions for enabling two-step verification for stronger account protection.