And the crux of this issue....
"Geotrust and other SSL issuers are supposed to do some basic due diligence to ensure that the entity requesting an SSL certificate is indeed authorized to request it on the company's behalf."

GeoTrust is a bass ackwards company and it's not surprising that they issued a cert to a phishing crew.

Like we've been saying for years, a valid cert does not necessarily mean that it represents a valid entity.