7/14/14 Sign in prevented

UA Information Security received a phishing report, with a warning that an attempted log-in was prevented to the recipient's UA NetID account.  While there are grammatical errors and the email address is not from an arizona.edu email address, the link leads to an exact replica of UA's WebAuth page, including information about signing up for NetID+.

If you receive this email, please delete it from your inbox.  If you clicked on the link, provided log-in information, or responded to the email, please contact your local IT support or the 24/7 IT Support Center (626-8324) as soon as possible.

Email text, including image of spoofed WebAuth page: 

 From: UNIVERSITY OF ARIZONA <EMAIL ADDRESS REMOVED>
Date: July 14, 2014 at 4:20:59 PM MST
To: Undisclosed-Recipients:;
Subject: Sign in prevented
 
We have just prevented a sign-in attempt on your UA Net ID account from another location, <URL REMOVED> to verify your profile.
 
Your prompt response regarding this matter is appreciated.
 
Sincerely,
 
THE UNIVERSITY OF ARIZONA
 
NOTE:  URL leads to "moonbirdie.com", not a UA website.
 
Spoofed WebAuth screenshot