Recent domain hijacks involving the .gh, .sl and .as country-code top-level domains (ccTLDs) reportedly enabled attackers to obtain HTTPS certificates for several Google-related domains. While the incident concerns internet infrastructure rather than a direct breach of most business systems, it matters because it shows how weaknesses at the domain registry level can undermine trust in websites and online services.

What happened

According to reporting cited in the source, attackers hijacked the .gh, .sl and .as ccTLDs. As a result, they were reportedly able to obtain valid HTTPS certificates for some Google domains under those country-code extensions.

This type of incident is significant because HTTPS certificates are used by browsers and systems to verify that a connection is encrypted and appears to belong to the expected domain. If attackers can control a domain zone or manipulate domain registration infrastructure, they may be able to create convincing fake services, intercept traffic in some scenarios, or support phishing and impersonation attacks.

Based on the source provided, the publicly reported issue concerns the affected ccTLD infrastructure and certificate issuance tied to those domains. The source does not indicate that this automatically means a wider compromise of all Google systems or of customer accounts.

Why it matters for European businesses

For European companies, the main takeaway is that domain trust depends not only on your own systems but also on registries, registrars, DNS providers and certificate authorities. Even businesses with strong internal security can still be exposed if external internet infrastructure is compromised.

This has practical implications in several areas:

• Brand protection: attackers may exploit trusted-looking domains and valid certificates to build more convincing phishing pages or impersonation campaigns.
• Website security: security teams that rely only on the presence of HTTPS as a trust signal may miss more advanced spoofing attempts.
• Email and identity risk: domain manipulation can increase the risk of spoofed communications, credential harvesting and redirection attacks.
• Third-party dependency risk: companies operating across multiple domains, markets or local country-code extensions may need stronger oversight of their domain portfolios.

For SMEs, this is a reminder that internet security is not limited to firewalls and endpoint protection. Domain configuration, registrar controls and certificate monitoring are part of the wider attack surface.

Who may be affected

• Businesses using ccTLDs for local market websites, brand protection or regional services.
• E-commerce companies that depend on domain trust for transactions and customer communications.
• Marketing teams and digital agencies managing multiple domains, redirects, landing pages or localised web properties.
• IT and security teams responsible for DNS, certificate management and website availability.
• Regulated businesses where domain impersonation could create compliance, fraud or customer notification risks.

What companies should consider

• Review domain governance: confirm who controls your domains, registrar accounts, DNS providers and recovery processes.
• Strengthen account security: use strong authentication and access controls for registrar, DNS and certificate management accounts.
• Monitor certificate issuance: consider monitoring for unexpected certificates issued for your domains and subdomains.
• Audit your ccTLD exposure: identify country-code domains in your portfolio and assess whether each remains necessary, actively monitored and securely managed.
• Update phishing awareness: remind staff that a padlock or HTTPS connection alone does not guarantee legitimacy.
• Prepare response procedures: make sure your incident response plan covers domain hijacking, DNS tampering and website impersonation scenarios.

Although this incident appears tied to specific country-code domains, it underlines a broader issue for European businesses: trust on the web depends on a chain of providers. Companies that rely on websites, e-commerce, cloud services and digital marketing should treat domain security as a core part of operational resilience.