Sucuri soon discovered that all these websites had been registered through NameCheap, a domain name registrar, and were using the company's FreeDNS service to redirect their domain name queries to the server IP address on which the site was hosted.
Read MoreRegarding how the malicious DNS entry ended up between authentic FreeDNS DNS servers, Sucuri's Denis Sinegubko has the following to say: "At this point it’s not clear what happened. Either someone hacked into the domain name registrar accounts and changed the name servers or someone compromised FreeDNS service and replaced one of their name servers."
