[pfg]

The bank's servers were unlikely to be involved at all. If the compromise happened at the registrar level - as the article indicates - the attackers could use their own DNS and web servers.

[DennisP]

But then the attackers wouldn't know what icon to show each customer (if the bank were using the system described above by emondi).

[pfg]

That's right. Ah, the dangers of replying to new comments without re-reading their parent. :-)