Confirmation email, is this one legit?

[ChipWiegand]

Is this the legit confirmation message from Dropbox? Notice the reply link at the bottom of the body of the message:

-----

Return-Path: <no-reply@dropbox.com>
Delivered-To: 
Received: from blue53.dnsmisitio.net
	by blue53.dnsmisitio.net (Dovecot) with LMTP id gc9UKdldqFmRUwUAixyE3A
	for ; Thu, 31 Aug 2017 16:04:57 -0300
Return-path: <no-reply@dropbox.com>
Envelope-to: 
Delivery-date: Thu, 31 Aug 2017 15:04:57 -0400
Received: from [127.0.0.1] (port=41031 helo=[103.205.112.43])
	by blue53.dnsmisitio.net with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
	(Exim 4.89)
	(envelope-from <no-reply@dropbox.com>)
	id 1dnUls-001UCT-Ny
	for ; Thu, 31 Aug 2017 15:04:57 -0400
X-Assp-ID: blue53.dnsmisitio.net id-06295-17034
X-Assp-Session: 7FDAEA0F8B28 (mail 1)
X-Assp-Envelope-From: no-reply@dropbox.com
X-Assp-Intended-For: 
X-Assp-Original-Subject: Please verify your email address
X-Assp-Version: 2.5.6(17050) on blue53.dnsmisitio.net
X-Assp-Server-TLS: yes
X-Assp-Message-Score: 39 (Suspicious HELO - contains IP: '[103.205.112.43]')
X-Assp-IP-Score: 39 (Suspicious HELO - contains IP: '[103.205.112.43]')
X-Assp-Whitelisted: Yes (whiteListedDomains '@dropbox.com')
X-Assp-Spam-Level: ********
Received: from unknown ([103.205.112.43] helo=[103.205.112.43]) by
	blue53.dnsmisitio.net with SMTP (2.5.6); 31 Aug 2017 16:04:54 -0300
From: "Dropbox" <no-reply@dropbox.com>
To: 
Subject: Please verify your email address
Date: Fri, 01 Sep 2017 00:34:48 +0530
Message-ID: <35254996b5adf0dd-3a024ef0-1211-2f36-1c5a-f5c423f6b52b-000000@us-west-2.amazonses.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_1218_6CABD1A8.24EA2592"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: PVmDLGKpeLDXGQiIoUFSSdvzO+BtNA==
X-Envelope-To: 
X-Dropbox-Message-ID: 45540132524967654566
X-From-Rewrite: unmodified, actual sender is root
X-Antivirus: Avast (VPS 170831-4, 08/31/2017), Inbound message
X-Antivirus-Status: Clean

This is a multipart message in MIME format.

------=_NextPart_000_1218_6CABD1A8.24EA2592
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: 7bit


  <https://cf.dropboxstatic.com/static/images/emails/glyph/glyph%402x.png>


Hi chip,

We just need to verify your email address before your sign up is complete!

Verify your email
<http://gestionale-orbit.it/dropbox.html>
Happy Dropboxing!

[Rich · Accepted solution]

Completely fake. The IP address is from an Internet service provider in India, and the domain is known for malware. Very likely a phishing attempt. Forward it (with full headers) to abuse@dropbox.com.

[ernstMreicher58]

forward to abuse@dropbox.com

[ChipWiegand]

I forwarded it onwards. I suspected it was just that - phishing attempt.

[Jane]

Hey @ChipWiegand, thanks for your cooperation on the matter! 

If it’s not too much trouble for you, would you mind taking a minute of your time to fill out a survey sharing your experience using the Dropbox Community? You can access it here: http://bit.ly/2lNKIxT .

[ Please feel free to get back in touch here at any time if you have any other Dropbox questions or experience any issues in the future. ]

Happy Dropboxing!

[This thread is now closed. If you have a similar or new question, you could post it in the Find Answers section here. Jane]