Happy outcome but could have so easily gone the other way. Surely it would have been been more responsible to locally fake the registration of the domain first

Happy outcome but could have so easily gone the other way. Surely it would have been been more responsible to locally fake the registration of the domain first (apparently as easy as modifying /etc/hosts in this case) given he had no idea how the payload would respond? o_O Not sure I'd be singing his praises if his rash decision had triggered the deletion of the encrypted files.