I don't think the sites themselves are doing it, rather a virus is scanning someone's favorites and sending out emails that emulate various domain names. Heck I got one from cnn.com a few days ago.

I came, I rendered, I'm still broke.