"all using the same provider" - could be the isp's dns server that was hacked.