Figure 5 Remote template document requesting the user to click “Enable Content” to run macro Clustering The delivery documents used in the October and November waves shared a large number of similarities, as seen in Table 1, which allowed us to cluster the activity together