As far as I can see, Heise assumes that just because there's a link to the URS, the domain is no longer under someone else's control. I can't find any confirmat

As far as I can see, Heise assumes that just because there's a link to the URS, the domain is no longer under someone else's control. I can't find any confirmation that the URS has actually been invoked. If I were someone trying to spy on specific users, or collecting data maliciously, I would host this HTML on my own server to confuse journalists. Currently, every subdomain (up to any level, as far as I can tell) resolves to an IPv4 and an IPv6 address. I doubt ICANN would do this for seized domains.