I know a lot of malware checks google.com to see if they are connected to the internet, as it is usually a site that is up and not blocked. Haven't looked into it yet to see if this is the case as well