The email contained a shortened bit.ly link to a domain registered by the attackers - drivers.documentsupportsharing[.]bid. In the statistics and usage page of the bit.ly URL we can see that the first click, likely a