Title: Phishing
license: https://www.apache.org/licenses/LICENSE-2.0

The credentials for your Apache account provide access to sensitive
information and resources, so you must protect them responsibly.
Phishing attacks, in which malicious actors try to steal your
credentials, are getting more sophisticated. Sometimes phishing
attempts may even appear to be coming from apache.org addresses.

The ASF, its projects, and committees will only ask you for your
credentials on websites served over https under the apache.org domain.

We never send emails with subjects like:

- 'cPanel delaying incoming messages'
- 'Important notification: Account password is set to expire'
- 'ATTENTION: Incoming Pending Messages'
- 'Action Required!!-Account Update'
- 'Password Notification for PROJECTNAME on ...'
- 'Release Blocked Incoming Messages'
- 'Your `...@apache.org` Rectification'
- 'Unauthorized Mailbox Log-in Detetced on ...'
- 'Deactivation of mailbox due to domain expiration'
- '[14] pending incoming mails'
- 'Syncing Error - (.) Incoming failed!'

These are phishing &mdash; some may even use our imagery and copycat websites.
Your best actions are to:

- not respond to the email
- forward the message, with full headers, to `root@apache.org`.

Further, 

-  Do not divulge your credentials to any service outside of **apache.org**.
-  In any email claiming to come from an apache.org address, do not click on any 'reset' or 'reauthenticate' links. We never ask you to do this.
-  If you think you have been a victim of phishing, reset your ASF password at <a href="http://id.apache.org/" target="_blank">id.apache.org</a>.

If you are unsure whether an email is actually from the ASF,
[contact the Infra team](contact.html). Better safe than sorry!

See also the [policy on sharing sensitive information with Infra](sensitive_info.html)
