My guess is they changed DNS so they could keep the service up while cutting off an attacker's route.