Sorry, I take back the word assumption if you're going to be semantic. 

Here's what I've seen, which I'm using to create my "theory":  I have 2 mining setups, both pointing to useast.wafflepool.com.  The two systems use different miners, one is using cgminer running under BAMT, the other is using cudaminer under win7.  Both systems are NAT'd behind a router running dd-wrt. 

With the difference in miners / systems, I don't think someone trojaning both my systems with different miners / OS's / authentications at the same time is likely.  With other people reporting the same issue, it makes a lot of sense that some sort of DNS hijack took place. 

I agree with you and don't recommend people hardcode an IP in their miner configs for long term use, but for the immediate future it would negate any sort of DNS issues should they continue.

No, right now it seems the us wafflepool.com endpoints are resolving properly when using google's dns:

nslookup useast.wafflepool.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    useast.wafflepool.com
Address:  162.243.89.19

nslookup uswest.wafflepool.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    uswest.wafflepool.com
Address:  192.241.211.125

I'm assuming that when my miners went down, there was a DNS hijack taking place and if you'd tried resolving wafflepool at that point, you'd get the bad IP's.  Looks like currently things are back to normal but I suggest keeping a close eye on your miners, maybe even direct setting the endpoint IP's in cgminer.conf in case this attack starts back up.

both my miners had switched to 206.223.224.2 - cgminer (bamt) and cudaminer (win7), both rigs using google public dns 8.8.8.8.

Doing lookup on the bad ip:

nslookup 206.223.224.2
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    true.fiberpimp.net
Address:  206.223.224.2



wafflepool now resolves properly:

nslookup useast.wafflepool.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    useast.wafflepool.com
Address:  162.243.89.19

Anyone else seeing a bunch of duplicate shares today?  I had to restart my rig today and after an hour I'm seeing ~2.3% rejects, all duplicate.  Most days I'm well under 1%.