[killswitched]

Why wouldn’t the wannacry malware writers register the domain first? Should be possible to simply update the name servers or dns records should the kill switch need to be engaged?

[derrikcurran]

Perhaps it wasn't a kill switch but rather a way to exempt certain organizations or countries from the effects of the malware.