Visited domains were being exfiltrated to a third-party server, seemingly under a Chinese actor's control.