Evidence archive
The documents, screen recordings, command outputs and sources behind the claims in the research files. Each record states what it shows and what it does not; a record's title takes you to its place in the research file.
Only records that have passed an editor's check are listed. Originals containing personal or sensitive information are not published; where needed, a redacted reader copy is used and the record says so.
7 of 7 records
Verisign RDAP response
Event date: 12 May 2017 · Obtained: 8 September 2026
Shows: The registration event 2017-05-12T15:08:04Z, the registrar Cloudflare, Inc. and the domain's status codes.
Does not show: It does not show who registered the domain or how the malware behaved.
Command output of the registration date
Event date: 12 May 2017 · Obtained: 8 September 2026, 20:53:33 UTC
Shows: Query time 2026-09-08T20:53:33Z; registration 2017-05-12T15:08:04Z; expiry 2027-05-12T15:08:04Z.
Does not show: It does not show who made the registration or how the 2017 attack unfolded.
Transcript of the HTTP and DNS queries
Obtained: 8 September 2026, 20:53:33 UTC
Shows: At 2026-09-08T20:53:33Z the domain returned HTTP 200 and 'Server: cloudflare'; its two A records were 104.16.166.228 and 104.16.167.228.
Does not show: It does not show the state on 30 August 2026 or in 2017, who runs the server, or any spread of the worm today. The network and DNS resolver used are not recorded.
Raw HTTP headers
Obtained: 8 September 2026, 20:53:33 UTC
Shows: HTTP/1.1 200 OK, the server time 'Tue, 08 Sep 2026 20:53:33 GMT', 'Server: cloudflare' and a CF-RAY identifier.
Does not show: It does not show the page content or who operates behind the server.
Raw DNS A record output
Obtained: not recorded
Shows: 104.16.166.228 and 104.16.167.228.
Does not show: It does not show the query time; the file has no time information.
Marcus Hutchins's account
Event date: 13 May 2017 · Obtained: not recorded
Shows: In the researcher's own words, his registration of the domain and the sample's behaviour tied to that address.
Does not show: It is not an independent record; because the RDAP response does not show the registrant, 'who registered it' rests on this account alone.
Microsoft Security Blog post
Event date: 12 May 2017 · Obtained: not recorded
Shows: A contemporaneous record of the ransomware that targeted out-of-date systems on 12 May 2017.
Does not show: It does not confirm the domain check or its registration.