That makes more sense, and a bit beyond my depth as well. But this is not the sites issue at this point, just some honest questions about the online fix.
I was under the impression we needed the online fix for it to work with other legitimate players. It doesn’t make sense to have an online fix if one isn’t needed. I’ll look into that part more, but I can see it being titled ransomware if they redirect queries to another server to make them go to the legit server and bypass the legit check.
Still depends on if we needed the online fix or not from the beginning, and then the question becomes, “how did they make the online check work, and where does it redirect to?”