[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOh-DDgKmPZME7wFStSgeAq-sQHv7JIcIGH0ssUqTt8g":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":110},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"91c5a5e6-db21-43de-9f03-01070f7db7af","Google Domains Impacted by Recent ccTLD Hijacks","google-domains-impacted-by-recent-cctld-hijacks-9fbb49","Hackers hijacked the .gh, .sl, and .as ccTLDs and obtained HTTPS certificates for several Google domains. The post Google Domains Impacted by Recent ccTLD Hijacks appeared first on SecurityWeek.","Google disclosed that several of its domains were impacted by a hijack of the .gh, .sl, and .as country-code top-level domains. Attackers modified DNS records and obtained unauthorized HTTPS certificates for Google domains and other organizations. Google blocked these certificates in Chrome and worked with CAs to revoke them, advising domain owners to monitor Certificate Transparency logs and implement restrictive CAA DNS records.","Hackers hijacked ccTLDs .gh, .sl, and .as, obtaining unauthorized HTTPS certificates for Google domains.","https:\u002F\u002Fwww.securityweek.com\u002Fgoogle-domains-impacted-by-recent-cctld-domain-hijacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FUnderminr-DNS-vulnerability.jpg","2026-10-09T11:43:14+00:00","2026-10-09T12:00:26.385657+00:00",7,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Chrome","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":104},[50,77],{"slug":51,"name":52,"problem":53,"products":54},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":72,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":72,"url":75,"description":76},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":78,"name":79,"problem":80,"products":81},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[82,90,96],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":91,"product_name":92,"url":94,"description":95},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",[105],{"slug":106,"name":18,"logo_path":107,"roles":108},"google","\u002Fvendor-logos\u002Fgoogle.png",[109],"affected",{"slug":111,"title":112,"body":113,"framework_refs":114,"framework_notes":124},"cctld-hijacks-expose-dns-and-certificate-authority-weaknesses","ccTLD Hijacks Expose DNS and Certificate Authority Weaknesses","Attackers exploited weaknesses at the country-code top-level domain (ccTLD) registry level to modify DNS records and fraudulently obtain HTTPS certificates for Google and other organizations' domains — without ever compromising those organizations directly. This illustrates that even well-resourced companies are vulnerable to infrastructure they do not control, such as upstream registries and certificate authorities. The attack undermines trust in core internet security mechanisms, including HTTPS and PKI. Without proactive monitoring of Certificate Transparency logs and restrictive CAA records, domain owners may not detect unauthorized certificate issuance until significant damage is done.",[115,116,117,118,119,120,121,122,123],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 8 – Audit Log Management","NIST SP 800-81-2 – Secure Domain Name System (DNS) Deployment Guide","NIST CSF DE.CM-7 – Monitoring for Unauthorized Activity","NIST SP 800-57 – Key Management (PKI\u002FCertificate Lifecycle)","RFC 8659 – DNS Certification Authority Authorization (CAA)","RFC 6962 – Certificate Transparency","ITIL – Service Configuration Management",{"RFC 6962 – Certificate Transparency":125,"CIS Control 8 – Audit Log Management":126,"ITIL – Service Configuration Management":127,"NIST CSF DE.CM-7 – Monitoring for Unauthorized Activity":128,"CIS Control 4 – Secure Configuration of Enterprise Assets":129,"CIS Control 1 – Inventory and Control of Enterprise Assets":130,"RFC 8659 – DNS Certification Authority Authorization (CAA)":131,"NIST SP 800-57 – Key Management (PKI\u002FCertificate Lifecycle)":132,"NIST SP 800-81-2 – Secure Domain Name System (DNS) Deployment Guide":133},"Certificate Transparency logs let organisations detect fraudulent HTTPS certificates issued for their domains.","Logging DNS and certificate changes helps detect unauthorised modifications quickly.","Configuration management of DNS records helps detect and reverse unauthorised changes.","Monitoring for unauthorised activity includes watching for unexpected DNS changes and certificate issuance.","Secure configuration includes registry locks and DNSSEC where available, reducing the risk of DNS tampering.","An inventory of domains and DNS assets helps organisations monitor critical domains, including those under ccTLDs.","CAA records limit which certificate authorities may issue for a domain, adding a check against fraudulent certificates.","Certificate lifecycle management includes monitoring for unauthorised certificates issued for your domains.","Secure DNS deployment guidance covers DNSSEC and registry protections relevant to ccTLD hijacking."]