Malicious archive download host serving ScreenConnect-bundled fake installers from spoofed sites in Cluster 2