As shown above, some of the decoy URLs point to the domain name of the actual C2 (e.g. are known to the C2 as being decoy resources that serve no role in the regular C2 communication between GoldMax and its C2