C2 domain used for stager hosting (web_script.txt), tunnel creation endpoints, and payload builder infrastructure