Update phishing.md added guidance

content/pages/phishing.md

@@ -18,14 +18,23 @@ We never send emails with subjects like:
 - 'Action Required!!-Account Update'
 - 'Password Notification for PROJECTNAME on ...'
 - 'Release Blocked Incoming Messages'
-- 'Your [[email protected]] Rectification'
+- 'Your `[email protected]` Rectification'
 - 'Unauthorized Mailbox Log-in Detetced on ...'
 - 'Deactivation of mailbox due to domain expiration'
 - '[14] pending incoming mails'
 - 'Syncing Error - (.) Incoming failed!'
 
 These are phishing — some may even use our imagery and copycat websites.
-Your best action is to ignore them.
+Your best actions are to:
+
+- not respond to the email
+- forward the message, with full headers, to `[email protected]`.
+
+Further, 
+
+-  Do not divulge your credentials to any service outside of **apache.org**.
+-  In any email claiming to come from an apache.org address, do not click on any 'reset' or 'reauthenticate' links. We never ask you to do this.
+-  If you think you have been a victim of phishing, reset your ASF password at <a href="http://id.apache.org/" target="_blank">id.apache.org</a>.
 
 If you are unsure whether an email is actually from the ASF,
-[contact](contact.html) the Infra team - better safe than sorry!
+[contact the Infra team](contact.html). Better safe than sorry!