In the Russian election interference investigation, they found that the spear-phishing sites setup to mimic google login pages all used the same link shortening service - this could be something like “Which Russian IP addresses accessed bit.ly/JohnPodesta” or a similar request.

Probably something like Iran and google. Somewhere controversial enough to get approved and a site common enough to be able to track the entire world.