If you receive any email asking you to click on a button/link to verify your email address with reasons like: email storage or server upgrade, email subscription renewal, storage quota exceeded, account reactivation – DO NOT click on that button/link nor respond to it as it is a phishing mail. The next actions that you should perform are to:

• Turn on junk filter if you haven't so.
• Blacklist the sender who sent this spam mail.
• Request your avomaster/voadmin to block the sender domain using Global Mail Rules.
• Ignore or delete this mail from your mailbox.

The following are some samples of phishing/scam mails and how you can identify them:

In this sample, the scammer is trying to trick the user by mentioning that the mailbox storage has exceeded its limit, and an email account update is required to receive new emails. The scammer also utilizes scare tactic, saying that the email account may be permanently disabled and data will be deleted if the user doesn't take any action.

There are several points to be noted here:

• Lookafter does not ask users to update email account or increase email space via URL link. All email space adjustment can only be done by your administrator (Avomaster/voadmin), refer here.
• If your mailbox is full, you will get a Mailbox full notification instead of such notice.
• Lookafter will NOT disable any user account nor delete any data without consent.
• If you hover over the button/link, you will notice that the URL is an unknown link, not from https://lookafter.com nor your website.
• The scam mail adopts scare tactic, which is a common trait in spam/phishing mails.

This sample shows a scam mail that asks user to reactivate account to receive some incoming messages that are placed on hold. It also threatens that the domain will be blocked if the user does not perform reactivation within the provided period.

The points to take note are:

• Again, we do not deactivate any user account without consent.
• Lookafter only places incoming emails that contain suspicious attachment in quarantine, where users can manage and decide whether to receive the email. Read more: Email Quarantined Reminder
• Similar to sample 1 above, this scam mail uses scare tactic, and the URL shown by hovering over the button/link is a suspicious link.

In this sample scam mail, the scammer asks the user to verify email address to complete an annual upgrade process. The content and layout may look different, but its charactistics are very similar to the other samples:

• Lookafter does not request users to verify email address to perform any upgrade process.
• Scare tactic is used again - implying that the account will be shut down if no action is taken.
• The “YES, THIS IS MY EMAIL” is displaying a suspicious link when you mouse-over it.