C2 domain with multiple subdomains (mail, php, sss) used for attacker command-and-control infrastructure
