It's not phishing -- astor tried it with a throwaway account and said it worked fine.