tokens: The message was sent from an account created under her name on lesser known email provider 1 1's Mail.com, a common tactic in recent months, with a link to a file hosted on Dropbox and an additional credential phishing attempt.