Carving botnet commands out of HTTP 200’s that use Content-Type application/octet-stream instead of text/plain. Guessing it isn’t ‘data’