In the Russian election interference investigation, they found that the spear-phishing sites setup to mimic google login pages all used the same link shortening service - this could be something like “Which Russian IP addresses accessed bit.ly/JohnPodesta” or a similar request.