Dropbox user X shared this document with you - O365 spam - Anyone else ?

[mikkydoos]

Hi all,

 

I'm getting reports of spam mail spoofing a dropbox file share from our mail users.

 

Header looks like this:

 

Received: from DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:207::34) by AM0PR03MB5890.eurprd03.prod.outlook.com with HTTPS via AM3PR04CA0150.EURPRD04.PROD.OUTLOOK.COM; Tue, 23 Jul 2019 10:36:13 +0000 Received: from DB6PR0301CA0050.eurprd03.prod.outlook.com (2603:10a6:4:54::18) by DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:10:e1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Tue, 23 Jul 2019 10:36:12 +0000 Received: from HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com (2a01:111:f400:7e1f::207) by DB6PR0301CA0050.outlook.office365.com (2603:10a6:4:54::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.12 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 Authentication-Results: spf=pass (sender IP is 54.240.39.208) smtp.mailfrom=email.dropbox.com; MYSCHOOL.co.uk; dkim=pass (signature was verified) header.d=dropbox.com;MYSCHOOL.co.uk; dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.208 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.208; helo=a39-208.smtp-out.amazonses.com; Received: from a39-208.smtp-out.amazonses.com (54.240.39.208) by HE1EUR01FT007.mail.protection.outlook.com (10.152.1.243) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=dropbox.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=H52D8ebjdJZ6j4YuF9e04TmncqqgtLdSv7IyupSyroZae5svpqFlWBo0hyApcWZN tU2jvOLje6XlOpuBfv7dVCrut2pPA/SIxVEp/6LQtWQVnUTMCc5H0pW8nkpW74Dv6Cg 7zIyvF6rn8SfR837HNBUPQlC0VZOQykhxr8XhxMU= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=amazonses.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=MbPiDQBlZOXtf15Px9Yv7apKR9S0V2cy9MzHxczc4ZwzP7XzmP/Ie+5THVnWsw8d ap4siDn666WzCo4oepeHgCpCsFaTnhrNX8hR2dwUtQwGQI0AvVFHqqHalqtCnO9jykw efNtQLydejpBBMQmEOBsjymeadnWpICr8DA7W0Rs= Content-Type: multipart/alternative; boundary="===============3807176310689868167==" MIME-Version: 1.0 From: "MYSCHOOL USER \(via Dropbox\)" To:

@myschool.co.uk CC: Subject: =?utf-8?q?MYSCHOOL_USER_shared_=22Wealth_Management_business_invitation?= =?utf-8?q?=2Epdf=22_with_you?= Date: Tue, 23 Jul 2019 10:36:10 +0000 Message-ID: <0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.amazonses.com> X-Dropbox-Message-ID: 5664988771583296602 Reply-To: [email protected] X-SES-Outgoing: 2019.07.23-54.240.39.208 Feedback-ID: 1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES Return-Path: 0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.dropbox.com X-MS-Exchange-Organization-ExpirationStartTime: 23 Jul 2019 10:36:12.6542 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-Forefront-Antispam-Report: CIP:54.240.39.208;IPV:NLI;CTRY:US;EFV:NLI;SFV:SFE;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:DB8PR03MB5899;H:a39-208.smtp-out.amazonses.com;FPR:;SPF:None;LANG:en; X-MS-Exchange-Organization-AuthSource: HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-Microsoft-Antispam: BCL:1;PCL:0;RULEID:(2390118)(7020095)(4652040)(5600148)(711020)(4605104)(4709080)(8001031)(1402095)(71702078);SRVR:DB8PR03MB5899; X-MS-TrafficTypeDiagnostic: DB8PR03MB5899: X-MS-Exchange-PUrlCount: 3 X-MS-Oob-TLC-OOBClassifiers: OLM:3631; X-MS-Exchange-Organization-SCL: -1 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jul 2019 10:36:12.2038 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-MS-Exchange-CrossTenant-Id: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6 X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR03MB5899 X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.3488099 X-MS-Exchange-Processed-By-BccFoldering: 15.20.2115.005 X-Microsoft-Antispam-Mailbox-Delivery: wl:1;pcwl:1;ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750119)(520011016)(520004050)(702028)(944504077)(944701077); X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?52XaUBHV9eSroMEvaiy18KCXToBAQCbPNyDhs1Mod3XSVCJCACqCSo09Pb6y?= =?us-ascii?Q?fk+x5/TlVYw1JzoTsWrhIbHdDzIGVSAKlJPyrodpJ5MikICt4XQmRT+C6tiM?= =?us-ascii?Q?ZOL/D/nttQZcCIy6Nq+vsNs5fdoZfm6mINcO2S8upGlBYL5zuoCOpw5fax9z?= =?us-ascii?Q?ZZ3XCTeJMFe0CGLGpByOJEVZPFmIvT3AKf470ADTs8QTkkVkNuW9oP7l2c/8?= =?us-ascii?Q?s+4YgTl2m7Bz1w1FyMFpQgaU6zyGZAzfDmH3zjJvV/fBbVLQgqjhTDtV6f5V?= =?us-ascii?Q?lkPrOppGJ0+wlzGxkpNycW+iUB2KL3cwRSVKiA9WtqjIVmKXrLlYEOJDMxkN?= =?us-ascii?Q?rK/czzrfaoYo1j5SmO8GJ4N/Tbwl9PIBrU8kCQUd9itNOwnvr50P9aaA5RHk?= =?us-ascii?Q?/AOCH3dwkM9/DiRowBCXU9ip9p0E43whc3fBIYf5UvdjblDpNEZLCgQSOeE5?= =?us-ascii?Q?oiZhE+PJRff5TbLwDOPx3gIYsBmLItUhFAappkZtpl22LT9UpIbxep966ppk?= =?us-ascii?Q?6KZK9/rmCUuiahoD+2zMMlQZE2/VRyFYEst/QfxlfuiMoS2AyloTaGLmabX0?= =?us-ascii?Q?SU4jg2G5LdDDeeTjuhZhPFBIuP/FeiTyjeObjeCXK4nCa/MeaLCrBitKGdAd?= =?us-ascii?Q?nlLzzxYkxkeksiMyLSMGkvpZNslJEJybUEPJaZLwlfERyRvTf6M3s6yFn/1M?= =?us-ascii?Q?Ae4dQd2LhPBechu3GqQOIUOKvQ4XQ6lOFUsCGtaE3U/7D79mdHXcS9Oac0c2?= =?us-ascii?Q?niQiMyriRkMBX1DOInj902FgzHPJE/WJAqYD0y6H3N/yqMDKhZLAoCsc6Xaz?= =?us-ascii?Q?8eRhoRFryUICpu7dOZ9HjlDzWpvnc1l+41IE5lo1Hu8fGv//QmPjOWy8K+Cf?= =?us-ascii?Q?L4OzqQaFkAKO3rW+rWUPUC9m9UQhWt096FSOkZfy5fgiNcFWuiLFt10+AVBO?= =?us-ascii?Q?Yr8pTGN5Vp87UwHXL71Bm/Bnb2NjST89iuBCMH9i0TPptzoeiQci2e9wa1V/?= =?us-ascii?Q?TvDQq7jCj1sWKQfU1ojFUtFHxbABRU2Wf1KwFONr3urNU5r/ziXbgrc+CmNa?= =?us-ascii?Q?H7wk+0i3PLwe63mRCMVzmCCveFgMG8Hex5XHl57Eltld2P2j8xcPmN3ecfpy?= =?us-ascii?Q?lqQM+rDzvJcomB3wSazFWbu6fyFIlsHwZTXvXKmwde1pYuvPbRG8fbI=3D?=spoofiReceived: from DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:207::34) by AM0PR03MB5890.eurprd03.prod.outlook.com with HTTPS via AM3PR04CA0150.EURPRD04.PROD.OUTLOOK.COM; Tue, 23 Jul 2019 10:36:13 +0000 Received: from DB6PR0301CA0050.eurprd03.prod.outlook.com (2603:10a6:4:54::18) by DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:10:e1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Tue, 23 Jul 2019 10:36:12 +0000 Received: from HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com (2a01:111:f400:7e1f::207) by DB6PR0301CA0050.outlook.office365.com (2603:10a6:4:54::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.12 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 Authentication-Results: spf=pass (sender IP is 54.240.39.208) smtp.mailfrom=email.dropbox.com; MYSCHOOL.co.uk; dkim=pass (signature was verified) header.d=dropbox.com;MYSCHOOL.co.uk; dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.208 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.208; helo=a39-208.smtp-out.amazonses.com; Received: from a39-208.smtp-out.amazonses.com (54.240.39.208) by HE1EUR01FT007.mail.protection.outlook.com (10.152.1.243) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=dropbox.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=H52D8ebjdJZ6j4YuF9e04TmncqqgtLdSv7IyupSyroZae5svpqFlWBo0hyApcWZN tU2jvOLje6XlOpuBfv7dVCrut2pPA/SIxVEp/6LQtWQVnUTMCc5H0pW8nkpW74Dv6Cg 7zIyvF6rn8SfR837HNBUPQlC0VZOQykhxr8XhxMU= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=amazonses.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=MbPiDQBlZOXtf15Px9Yv7apKR9S0V2cy9MzHxczc4ZwzP7XzmP/Ie+5THVnWsw8d ap4siDn666WzCo4oepeHgCpCsFaTnhrNX8hR2dwUtQwGQI0AvVFHqqHalqtCnO9jykw efNtQLydejpBBMQmEOBsjymeadnWpICr8DA7W0Rs= Content-Type: multipart/alternative; boundary="===============3807176310689868167==" MIME-Version: 1.0 From: "MYSCHOOL USER \(via Dropbox\)" To:

@myschool.co.uk CC: Subject: =?utf-8?q?MYSCHOOL_USER_shared_=22Wealth_Management_business_invitation?= =?utf-8?q?=2Epdf=22_with_you?= Date: Tue, 23 Jul 2019 10:36:10 +0000 Message-ID: <0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.amazonses.com> X-Dropbox-Message-ID: 5664988771583296602 Reply-To: [email protected] X-SES-Outgoing: 2019.07.23-54.240.39.208 Feedback-ID: 1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES Return-Path: 0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.dropbox.com X-MS-Exchange-Organization-ExpirationStartTime: 23 Jul 2019 10:36:12.6542 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-Forefront-Antispam-Report: CIP:54.240.39.208;IPV:NLI;CTRY:US;EFV:NLI;SFV:SFE;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:DB8PR03MB5899;H:a39-208.smtp-out.amazonses.com;FPR:;SPF:None;LANG:en; X-MS-Exchange-Organization-AuthSource: HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-Microsoft-Antispam: BCL:1;PCL:0;RULEID:(2390118)(7020095)(4652040)(5600148)(711020)(4605104)(4709080)(8001031)(1402095)(71702078);SRVR:DB8PR03MB5899; X-MS-TrafficTypeDiagnostic: DB8PR03MB5899: X-MS-Exchange-PUrlCount: 3 X-MS-Oob-TLC-OOBClassifiers: OLM:3631; X-MS-Exchange-Organization-SCL: -1 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jul 2019 10:36:12.2038 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-MS-Exchange-CrossTenant-Id: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6 X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR03MB5899 X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.3488099 X-MS-Exchange-Processed-By-BccFoldering: 15.20.2115.005 X-Microsoft-Antispam-Mailbox-Delivery: wl:1;pcwl:1;ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750119)(520011016)(520004050)(702028)(944504077)(944701077); X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?52XaUBHV9eSroMEvaiy18KCXToBAQCbPNyDhs1Mod3XSVCJCACqCSo09Pb6y?= =?us-ascii?Q?fk+x5/TlVYw1JzoTsWrhIbHdDzIGVSAKlJPyrodpJ5MikICt4XQmRT+C6tiM?= =?us-ascii?Q?ZOL/D/nttQZcCIy6Nq+vsNs5fdoZfm6mINcO2S8upGlBYL5zuoCOpw5fax9z?= =?us-ascii?Q?ZZ3XCTeJMFe0CGLGpByOJEVZPFmIvT3AKf470ADTs8QTkkVkNuW9oP7l2c/8?= =?us-ascii?Q?s+4YgTl2m7Bz1w1FyMFpQgaU6zyGZAzfDmH3zjJvV/fBbVLQgqjhTDtV6f5V?= =?us-ascii?Q?lkPrOppGJ0+wlzGxkpNycW+iUB2KL3cwRSVKiA9WtqjIVmKXrLlYEOJDMxkN?= =?us-ascii?Q?rK/czzrfaoYo1j5SmO8GJ4N/Tbwl9PIBrU8kCQUd9itNOwnvr50P9aaA5RHk?= =?us-ascii?Q?/AOCH3dwkM9/DiRowBCXU9ip9p0E43whc3fBIYf5UvdjblDpNEZLCgQSOeE5?= =?us-ascii?Q?oiZhE+PJRff5TbLwDOPx3gIYsBmLItUhFAappkZtpl22LT9UpIbxep966ppk?= =?us-ascii?Q?6KZK9/rmCUuiahoD+2zMMlQZE2/VRyFYEst/QfxlfuiMoS2AyloTaGLmabX0?= =?us-ascii?Q?SU4jg2G5LdDDeeTjuhZhPFBIuP/FeiTyjeObjeCXK4nCa/MeaLCrBitKGdAd?= =?us-ascii?Q?nlLzzxYkxkeksiMyLSMGkvpZNslJEJybUEPJaZLwlfERyRvTf6M3s6yFn/1M?= =?us-ascii?Q?Ae4dQd2LhPBechu3GqQOIUOKvQ4XQ6lOFUsCGtaE3U/7D79mdHXcS9Oac0c2?= =?us-ascii?Q?niQiMyriRkMBX1DOInj902FgzHPJE/WJAqYD0y6H3N/yqMDKhZLAoCsc6Xaz?= =?us-ascii?Q?8eRhoRFryUICpu7dOZ9HjlDzWpvnc1l+41IE5lo1Hu8fGv//QmPjOWy8K+Cf?= =?us-ascii?Q?L4OzqQaFkAKO3rW+rWUPUC9m9UQhWt096FSOkZfy5fgiNcFWuiLFt10+AVBO?= =?us-ascii?Q?Yr8pTGN5Vp87UwHXL71Bm/Bnb2NjST89iuBCMH9i0TPptzoeiQci2e9wa1V/?= =?us-ascii?Q?TvDQq7jCj1sWKQfU1ojFUtFHxbABRU2Wf1KwFONr3urNU5r/ziXbgrc+CmNa?= =?us-ascii?Q?H7wk+0i3PLwe63mRCMVzmCCveFgMG8Hex5XHl57Eltld2P2j8xcPmN3ecfpy?= =?us-ascii?Q?lqQM+rDzvJcomB3wSazFWbu6fyFIlsHwZTXvXKmwde1pYuvPbRG8fbI=3D?=

 

 

 

 

 

 

I can't tell where its coming from except Amazon AWS?

 

The link looks genuine too... and when clicked on goes to what appears to be a genuine dropbox URL.

 

Is anyone else getting these ?

[smithson83]

Hi all,

 

I'm getting reports of spam mail spoofing a dropbox file share from our mail users.

 

Header looks like this:

 

Received: from DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:207::34) by AM0PR03MB5890.eurprd03.prod.outlook.com with HTTPS via AM3PR04CA0150.EURPRD04.PROD.OUTLOOK.COM; Tue, 23 Jul 2019 10:36:13 +0000 Received: from DB6PR0301CA0050.eurprd03.prod.outlook.com (2603:10a6:4:54::18) by DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:10:e1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Tue, 23 Jul 2019 10:36:12 +0000 Received: from HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com (2a01:111:f400:7e1f::207) by DB6PR0301CA0050.outlook.office365.com (2603:10a6:4:54::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.12 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 Authentication-Results: spf=pass (sender IP is 54.240.39.208) smtp.mailfrom=email.dropbox.com; MYSCHOOL.co.uk; dkim=pass (signature was verified) header.d=dropbox.com;MYSCHOOL.co.uk; dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.208 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.208; helo=a39-208.smtp-out.amazonses.com; Received: from a39-208.smtp-out.amazonses.com (54.240.39.208) by HE1EUR01FT007.mail.protection.outlook.com (10.152.1.243) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=dropbox.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=H52D8ebjdJZ6j4YuF9e04TmncqqgtLdSv7IyupSyroZae5svpqFlWBo0hyApcWZN tU2jvOLje6XlOpuBfv7dVCrut2pPA/SIxVEp/6LQtWQVnUTMCc5H0pW8nkpW74Dv6Cg 7zIyvF6rn8SfR837HNBUPQlC0VZOQykhxr8XhxMU= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=amazonses.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=MbPiDQBlZOXtf15Px9Yv7apKR9S0V2cy9MzHxczc4ZwzP7XzmP/Ie+5THVnWsw8d ap4siDn666WzCo4oepeHgCpCsFaTnhrNX8hR2dwUtQwGQI0AvVFHqqHalqtCnO9jykw efNtQLydejpBBMQmEOBsjymeadnWpICr8DA7W0Rs= Content-Type: multipart/alternative; boundary="===============3807176310689868167==" MIME-Version: 1.0 From: "MYSCHOOL USER \(via Dropbox\)" To:

@myschool.co.uk CC: Subject: =?utf-8?q?MYSCHOOL_USER_shared_=22Wealth_Management_business_invitation?= =?utf-8?q?=2Epdf=22_with_you?= Date: Tue, 23 Jul 2019 10:36:10 +0000 Message-ID: <0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.amazonses.com> X-Dropbox-Message-ID: 5664988771583296602 Reply-To: [email protected] X-SES-Outgoing: 2019.07.23-54.240.39.208 Feedback-ID: 1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES Return-Path: 0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.dropbox.com X-MS-Exchange-Organization-ExpirationStartTime: 23 Jul 2019 10:36:12.6542 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-Forefront-Antispam-Report: CIP:54.240.39.208;IPV:NLI;CTRY:US;EFV:NLI;SFV:SFE;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:DB8PR03MB5899;H:a39-208.smtp-out.amazonses.com;FPR:;SPF:None;LANG:en; X-MS-Exchange-Organization-AuthSource: HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-Microsoft-Antispam: BCL:1;PCL:0;RULEID:(2390118)(7020095)(4652040)(5600148)(711020)(4605104)(4709080)(8001031)(1402095)(71702078);SRVR:DB8PR03MB5899; X-MS-TrafficTypeDiagnostic: DB8PR03MB5899: X-MS-Exchange-PUrlCount: 3 X-MS-Oob-TLC-OOBClassifiers: OLM:3631; X-MS-Exchange-Organization-SCL: -1 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jul 2019 10:36:12.2038 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-MS-Exchange-CrossTenant-Id: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6 X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR03MB5899 X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.3488099 X-MS-Exchange-Processed-By-BccFoldering: 15.20.2115.005 X-Microsoft-Antispam-Mailbox-Delivery: wl:1;pcwl:1;ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750119)(520011016)(520004050)(702028)(944504077)(944701077); X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?52XaUBHV9eSroMEvaiy18KCXToBAQCbPNyDhs1Mod3XSVCJCACqCSo09Pb6y?= =?us-ascii?Q?fk+x5/TlVYw1JzoTsWrhIbHdDzIGVSAKlJPyrodpJ5MikICt4XQmRT+C6tiM?= =?us-ascii?Q?ZOL/D/nttQZcCIy6Nq+vsNs5fdoZfm6mINcO2S8upGlBYL5zuoCOpw5fax9z?= =?us-ascii?Q?ZZ3XCTeJMFe0CGLGpByOJEVZPFmIvT3AKf470ADTs8QTkkVkNuW9oP7l2c/8?= =?us-ascii?Q?s+4YgTl2m7Bz1w1FyMFpQgaU6zyGZAzfDmH3zjJvV/fBbVLQgqjhTDtV6f5V?= =?us-ascii?Q?lkPrOppGJ0+wlzGxkpNycW+iUB2KL3cwRSVKiA9WtqjIVmKXrLlYEOJDMxkN?= =?us-ascii?Q?rK/czzrfaoYo1j5SmO8GJ4N/Tbwl9PIBrU8kCQUd9itNOwnvr50P9aaA5RHk?= =?us-ascii?Q?/AOCH3dwkM9/DiRowBCXU9ip9p0E43whc3fBIYf5UvdjblDpNEZLCgQSOeE5?= =?us-ascii?Q?oiZhE+PJRff5TbLwDOPx3gIYsBmLItUhFAappkZtpl22LT9UpIbxep966ppk?= =?us-ascii?Q?6KZK9/rmCUuiahoD+2zMMlQZE2/VRyFYEst/QfxlfuiMoS2AyloTaGLmabX0?= =?us-ascii?Q?SU4jg2G5LdDDeeTjuhZhPFBIuP/FeiTyjeObjeCXK4nCa/MeaLCrBitKGdAd?= =?us-ascii?Q?nlLzzxYkxkeksiMyLSMGkvpZNslJEJybUEPJaZLwlfERyRvTf6M3s6yFn/1M?= =?us-ascii?Q?Ae4dQd2LhPBechu3GqQOIUOKvQ4XQ6lOFUsCGtaE3U/7D79mdHXcS9Oac0c2?= =?us-ascii?Q?niQiMyriRkMBX1DOInj902FgzHPJE/WJAqYD0y6H3N/yqMDKhZLAoCsc6Xaz?= =?us-ascii?Q?8eRhoRFryUICpu7dOZ9HjlDzWpvnc1l+41IE5lo1Hu8fGv//QmPjOWy8K+Cf?= =?us-ascii?Q?L4OzqQaFkAKO3rW+rWUPUC9m9UQhWt096FSOkZfy5fgiNcFWuiLFt10+AVBO?= =?us-ascii?Q?Yr8pTGN5Vp87UwHXL71Bm/Bnb2NjST89iuBCMH9i0TPptzoeiQci2e9wa1V/?= =?us-ascii?Q?TvDQq7jCj1sWKQfU1ojFUtFHxbABRU2Wf1KwFONr3urNU5r/ziXbgrc+CmNa?= =?us-ascii?Q?H7wk+0i3PLwe63mRCMVzmCCveFgMG8Hex5XHl57Eltld2P2j8xcPmN3ecfpy?= =?us-ascii?Q?lqQM+rDzvJcomB3wSazFWbu6fyFIlsHwZTXvXKmwde1pYuvPbRG8fbI=3D?=spoofiReceived: from DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:207::34) by AM0PR03MB5890.eurprd03.prod.outlook.com with HTTPS via AM3PR04CA0150.EURPRD04.PROD.OUTLOOK.COM; Tue, 23 Jul 2019 10:36:13 +0000 Received: from DB6PR0301CA0050.eurprd03.prod.outlook.com (2603:10a6:4:54::18) by DB8PR03MB5899.eurprd03.prod.outlook.com (2603:10a6:10:e1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Tue, 23 Jul 2019 10:36:12 +0000 Received: from HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com (2a01:111:f400:7e1f::207) by DB6PR0301CA0050.outlook.office365.com (2603:10a6:4:54::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.12 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 Authentication-Results: spf=pass (sender IP is 54.240.39.208) smtp.mailfrom=email.dropbox.com; MYSCHOOL.co.uk; dkim=pass (signature was verified) header.d=dropbox.com;MYSCHOOL.co.uk; dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.208 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.208; helo=a39-208.smtp-out.amazonses.com; Received: from a39-208.smtp-out.amazonses.com (54.240.39.208) by HE1EUR01FT007.mail.protection.outlook.com (10.152.1.243) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Tue, 23 Jul 2019 10:36:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=dropbox.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=H52D8ebjdJZ6j4YuF9e04TmncqqgtLdSv7IyupSyroZae5svpqFlWBo0hyApcWZN tU2jvOLje6XlOpuBfv7dVCrut2pPA/SIxVEp/6LQtWQVnUTMCc5H0pW8nkpW74Dv6Cg 7zIyvF6rn8SfR837HNBUPQlC0VZOQykhxr8XhxMU= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=amazonses.com; t=1563878170; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=OMAmA2LiEeFWbGB2PlnoZlL7CkXqBxCpeU+pPX+/Wso=; b=MbPiDQBlZOXtf15Px9Yv7apKR9S0V2cy9MzHxczc4ZwzP7XzmP/Ie+5THVnWsw8d ap4siDn666WzCo4oepeHgCpCsFaTnhrNX8hR2dwUtQwGQI0AvVFHqqHalqtCnO9jykw efNtQLydejpBBMQmEOBsjymeadnWpICr8DA7W0Rs= Content-Type: multipart/alternative; boundary="===============3807176310689868167==" MIME-Version: 1.0 From: "MYSCHOOL USER \(via Dropbox\)" To:

@myschool.co.uk CC: Subject: =?utf-8?q?MYSCHOOL_USER_shared_=22Wealth_Management_business_invitation?= =?utf-8?q?=2Epdf=22_with_you?= Date: Tue, 23 Jul 2019 10:36:10 +0000 Message-ID: <0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.amazonses.com> X-Dropbox-Message-ID: 5664988771583296602 Reply-To: [email protected] X-SES-Outgoing: 2019.07.23-54.240.39.208 Feedback-ID: 1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES Return-Path: 0100016c1e671fbd-131a5710-745f-4f38-b035-c389b7d4709e-000000@email.dropbox.com X-MS-Exchange-Organization-ExpirationStartTime: 23 Jul 2019 10:36:12.6542 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-Forefront-Antispam-Report: CIP:54.240.39.208;IPV:NLI;CTRY:US;EFV:NLI;SFV:SFE;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:DB8PR03MB5899;H:a39-208.smtp-out.amazonses.com;FPR:;SPF:None;LANG:en; X-MS-Exchange-Organization-AuthSource: HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-Microsoft-Antispam: BCL:1;PCL:0;RULEID:(2390118)(7020095)(4652040)(5600148)(711020)(4605104)(4709080)(8001031)(1402095)(71702078);SRVR:DB8PR03MB5899; X-MS-TrafficTypeDiagnostic: DB8PR03MB5899: X-MS-Exchange-PUrlCount: 3 X-MS-Oob-TLC-OOBClassifiers: OLM:3631; X-MS-Exchange-Organization-SCL: -1 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jul 2019 10:36:12.2038 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b099ddfc-d69f-479e-4aaf-08d70f59953d X-MS-Exchange-CrossTenant-Id: ba8f1083-79b8-4ee2-9d29-eb7afc8dfef6 X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR03MB5899 X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.3488099 X-MS-Exchange-Processed-By-BccFoldering: 15.20.2115.005 X-Microsoft-Antispam-Mailbox-Delivery: wl:1;pcwl:1;ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750119)(520011016)(520004050)(702028)(944504077)(944701077); X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?52XaUBHV9eSroMEvaiy18KCXToBAQCbPNyDhs1Mod3XSVCJCACqCSo09Pb6y?= =?us-ascii?Q?fk+x5/TlVYw1JzoTsWrhIbHdDzIGVSAKlJPyrodpJ5MikICt4XQmRT+C6tiM?= =?us-ascii?Q?ZOL/D/nttQZcCIy6Nq+vsNs5fdoZfm6mINcO2S8upGlBYL5zuoCOpw5fax9z?= =?us-ascii?Q?ZZ3XCTeJMFe0CGLGpByOJEVZPFmIvT3AKf470ADTs8QTkkVkNuW9oP7l2c/8?= =?us-ascii?Q?s+4YgTl2m7Bz1w1FyMFpQgaU6zyGZAzfDmH3zjJvV/fBbVLQgqjhTDtV6f5V?= =?us-ascii?Q?lkPrOppGJ0+wlzGxkpNycW+iUB2KL3cwRSVKiA9WtqjIVmKXrLlYEOJDMxkN?= =?us-ascii?Q?rK/czzrfaoYo1j5SmO8GJ4N/Tbwl9PIBrU8kCQUd9itNOwnvr50P9aaA5RHk?= =?us-ascii?Q?/AOCH3dwkM9/DiRowBCXU9ip9p0E43whc3fBIYf5UvdjblDpNEZLCgQSOeE5?= =?us-ascii?Q?oiZhE+PJRff5TbLwDOPx3gIYsBmLItUhFAappkZtpl22LT9UpIbxep966ppk?= =?us-ascii?Q?6KZK9/rmCUuiahoD+2zMMlQZE2/VRyFYEst/QfxlfuiMoS2AyloTaGLmabX0?= =?us-ascii?Q?SU4jg2G5LdDDeeTjuhZhPFBIuP/FeiTyjeObjeCXK4nCa/MeaLCrBitKGdAd?= =?us-ascii?Q?nlLzzxYkxkeksiMyLSMGkvpZNslJEJybUEPJaZLwlfERyRvTf6M3s6yFn/1M?= =?us-ascii?Q?Ae4dQd2LhPBechu3GqQOIUOKvQ4XQ6lOFUsCGtaE3U/7D79mdHXcS9Oac0c2?= =?us-ascii?Q?niQiMyriRkMBX1DOInj902FgzHPJE/WJAqYD0y6H3N/yqMDKhZLAoCsc6Xaz?= =?us-ascii?Q?8eRhoRFryUICpu7dOZ9HjlDzWpvnc1l+41IE5lo1Hu8fGv//QmPjOWy8K+Cf?= =?us-ascii?Q?L4OzqQaFkAKO3rW+rWUPUC9m9UQhWt096FSOkZfy5fgiNcFWuiLFt10+AVBO?= =?us-ascii?Q?Yr8pTGN5Vp87UwHXL71Bm/Bnb2NjST89iuBCMH9i0TPptzoeiQci2e9wa1V/?= =?us-ascii?Q?TvDQq7jCj1sWKQfU1ojFUtFHxbABRU2Wf1KwFONr3urNU5r/ziXbgrc+CmNa?= =?us-ascii?Q?H7wk+0i3PLwe63mRCMVzmCCveFgMG8Hex5XHl57Eltld2P2j8xcPmN3ecfpy?= =?us-ascii?Q?lqQM+rDzvJcomB3wSazFWbu6fyFIlsHwZTXvXKmwde1pYuvPbRG8fbI=3D?=

 

 

 

 

 

 

I can't tell where its coming from except Amazon AWS?

 

The link looks genuine too... and when clicked on goes to what appears to be a genuine dropbox URL.

 

Is anyone else getting these ?

I've had a few of these come through yesterday evening for a few users. Will be investigating when I get in.

[bald_pig]

It's passed DKIM, so the email is apparently legit...

 

I wonder if they are now using dropbox to spread a malicious payload to make it more convincing to open? In any case, it looks like one of your users may have fallen for it if it's in their name with their email as the replyto address.