Seventeen days after 84-year-old Nancy Guthrie vanished from her Tucson, Arizona home, investigators are scrutinizing a small but potentially revealing detail: what appears to be a pinky ring worn beneath black gloves by an unknown male figure captured on her Nest doorbell camera at 2:12 AM on February 1.

The same day, a new ransom note surfaced. TMZ announced Wednesday that it received what the outlet called a "sophisticated" demand that places the media directly in the middle of the case.

Nancy Guthrie, the mother of Today show host Savannah Guthrie, has not been seen or heard from since the night of January 31. The case has drawn national attention, and the FBI has expanded its investigation to include contact with law enforcement in Mexico, though that effort has not yielded new leads.

The doorbell footage and a ring beneath the glove

Pima County Sheriff Chris Nanos addressed the pinky ring detail on Tuesday after it was flagged in the doorbell camera footage. His response to NBC News was measured but notable.

"I look at the same photo you look at and I get it, I see it."

He continued:

"I'm going to give that to my team. They'll look at that. They'll analyze it and we'll see. Maybe, maybe it is."

It is the kind of detail that could matter enormously or not at all. A ring worn under a glove suggests someone who either forgot to remove it or didn't think it would be visible. Either way, it narrows the field. Rings are identifiable. They are personal. They are the kind of item someone close to the investigation might recognize.

A separate piece of physical evidence, a single glove found two miles from Nancy's home, has already been tested, the Daily Mail reported. It failed to match any profile in CODIS, the national DNA database. Sheriff Nanos indicated the glove yielded no new leads.

A ransom note designed to weaponize the press

The new ransom demand represents an escalation in both tone and tactics. TMZ announced the note in an Instagram post:

"We have received yet another ransom demand—this one is sophisticated and puts the media right in the middle of it."

Harvey Levin described the scheme as one in which "the media essentially becomes a go-between, a trigger if you will, for getting this ransom money." The note demands another large sum in cryptocurrency, distinct from the $6 million in bitcoin previously requested in earlier ransom communications. It reportedly describes in graphic terms the consequences if the ransom is not paid.

The cryptocurrency account number from the new message has been forwarded to the FBI for review.

Several ransom notes have now surfaced over the course of this case, some directed at media outlets. The strategy of routing demands through the press is calculated. It forces coverage, creates pressure on the family, and turns every news cycle into leverage. Whether the notes are from someone who actually has Nancy Guthrie or from an opportunist exploiting a high-profile disappearance remains unknown.

What the timeline reveals

The known facts paint a precise and troubling picture:

• On the night of January 31, Nancy had dinner and a game night at the home of her eldest daughter, Annie.
• Annie's husband, Tommaso Cioni, drove Nancy home and told police he watched her enter through her garage door.
• At approximately 2:12 AM, her Nest doorbell camera detected an unknown person.
• By roughly 2:30 AM, her Apple Watch and iPhone had stopped syncing with her pacemaker.
• She failed to appear at church the following morning. Friends grew concerned, the family checked her home, could not find her, and called 911 around 11 AM.

The window between Cioni watching her walk inside and the doorbell camera activation is the critical gap. Something happened in those hours. The cessation of her devices syncing with her pacemaker at 2:30 AM suggests that whatever occurred was already underway or complete by that time.

A daughter's plea

Savannah Guthrie shared a video on Instagram on Sunday night, captioned "bring her home." Her words were directed at whoever may have her mother:

"And I wanted to say to whoever has her or knows where she is that it's never too late, and you're not lost or alone, and it is never too late to do the right thing."

"We are here and we believe, and we believe in the essential goodness of every human being, and it's never too late."

There is no political valence to a daughter asking for her mother back. It is simply grief reaching for hope in a public forum because the private channels have gone silent.

Where the investigation stands

Persons of interest were previously brought in for questioning and released. The FBI's outreach to Mexican law enforcement has produced nothing actionable. The glove is a dead end for now. The ransom notes keep arriving, but no proof of life has been publicly confirmed.

What investigators do have is a doorbell camera image of someone who may have been wearing a pinky ring under a glove at two in the morning outside the home of an 84-year-old woman who has not been seen since. That is nothing. Rings have histories. They are purchased, gifted, engraved, and sized. If the ring is real, it is a thread. And threads, pulled carefully, unravel cases.

Seventeen days is a long time for an 84-year-old woman with a pacemaker to be missing. Every day that passes without answers makes the next day harder. But the details are accumulating, and details are what solve cases when everything else has stalled.