[rahimnathwani]

> How would they have got a proper CA signed cert for a domain they don't own?

No need. People probably don't look closely at the domain name.