Malware now doing the DNS switcheroo