This phish is a part of a recent phish wave directed at Earthlink customers. It is quite probable that the whole campaign comes from a single source (a single group of people).

The phish message is a very plain one :

And it really is close enough to, let's say, 'manager.earthlink.com'. Something completely acceptable for most users. Remember, phishers do not try to fool computer gurus. The effort won't pay off. They are after the mass of the overly gullable ones.

After 'logging in', the phish site displays its main page:

It will run any validation check on what you enter (except the expiration date, and whether the CC fields are not empty), so it will accept any bogus information, as it accepted our bogus 'credit card'. The URL in the address bar remains the same. It is one of the two most important clues of phishing, along with the site not being a secure one.

A standard looking logout screen appears next:

This phish is a good illustration of the con-style phish - a URL closely matching the legitimate one is chosen, and the site is made generally believable.

Again, the two most important clues of phishing here are the mentioned URL and the lack of security on the site (indicated by the lack of a lock icon in the lower right end of the status bar in IE, for example).