It's worth noting that "success" here is getting the target to click a link, and not (for example) handing over personal information or credentials.