CeMeNoMore is right. It does appear that .qa registry was compromised which would redirect the sites.