C2 domain used by newer Cavern agent builds (build 04); google.com prefix is a visual deception trick for proxy log skimming
