I don't think they were duped at all. From what I can tell from the article, this is malware pointing machines to a bogus DNS server, not businesses using a sha

I don't think they were duped at all. From what I can tell from the article, this is malware pointing machines to a bogus DNS server, not businesses using a shady registrar. These is little an affected business could do about it. I'm not sure if sanswork is describing the same thing but he could be.