Google says recent attacks against country-code top-level domain registries allowed attackers to change authoritative DNS records and obtain unauthorized HTTPS certificates for Google domains and other organizations.

The incidents affected the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) namespaces, according to Google’s Chrome security team. Google said the events did not involve a compromise of Google systems; instead, attackers compromised third-party ccTLD registry infrastructure, creating risk for domains under those TLDs.

For hosting providers, registrars, managed WordPress shops, and site operators, the episode is a reminder that domain control is part of the security boundary. If registry- or registrar-side access is abused, attackers may be able to redirect traffic long enough to satisfy certificate issuance checks, even when the origin hosting account remains untouched.

Google said Chrome blocked the unauthorized certificates for Google properties through CRLSets and worked with certificate authorities to revoke them. Certificate Transparency logs then showed additional organizations appeared to have been affected, prompting Chrome to proactively block more certificates where possible.

The practical checklist for operators is straightforward: monitor Certificate Transparency for unexpected issuances, keep registrar and registry account access locked down with MFA and role controls, alert on authoritative DNS changes, and maintain an incident path for emergency DNS rollback and certificate revocation.

Google’s Chrome security team published the primary advisory. The Register also reported on the attacks and their certificate impact.