Google Domains Impacted by Recent ccTLD Hijacks
Hackers hijacked ccTLDs .gh, .sl, and .as, obtaining unauthorized HTTPS certificates for Google domains.
Google disclosed that several of its domains were impacted by a hijack of the .gh, .sl, and .as country-code top-level domains. Attackers modified DNS records and obtained unauthorized HTTPS certificates for Google domains and other organizations. Google blocked these certificates in Chrome and worked with CAs to revoke them, advising domain owners to monitor Certificate Transparency logs and implement restrictive CAA DNS records.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited weaknesses at the country-code top-level domain (ccTLD) registry level to modify DNS records and fraudulently obtain HTTPS certificates for Google and other organizations' domains — without ever compromising those organizations directly. This illustrates that even well-resourced companies are vulnerable to infrastructure they do not control, such as upstream registries and certificate authorities. The attack undermines trust in core internet security mechanisms, including HTTPS and PKI. Without proactive monitoring of Certificate Transparency logs and restrictive CAA records, domain owners may not detect unauthorized certificate issuance until significant damage is done.
What helps against this
How we list vendors
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.