> Note: The domains in red were not registered at the time of my research, although they were registered last night by an unknown entity. They seem to be back u

> Note: The domains in red were not registered at the time of my research, although they were registered last night by an unknown entity. They seem to be back up domains in case one of the first two stops working. Or they could be domains for checking if you're in a sandbox like WanaCrypt. Why wouldn't you just use 20 well known domains otherwise?