It doesn't even seem to collect the email address when you first go there. There's a uid param in the phishing link that sets the username field automatically and then it works.

Of course it first says "login failed" after a few seconds and after the second try, it redirects to the domain from the email.
manually typed address
manually typed address
with ?uid set