Warning: just a guess, I don't actually know

Probably a combination of the DNS hijack + no HSTS

Alternatively, let's encrypt (and probably others) has DNS based verification.