> gained the ability to create subdomains under a legitimate domain As lots of people in this thread have already pointed out, that's the security problem. The

> gained the ability to create subdomains under a legitimate domain As lots of people in this thread have already pointed out, that's the security problem. The DNS zone that was delegated to you, then you have a responsibility to keep the "squatters" away. > Traffic to this created subdomain was protected with HTTPS Good. HTTP is obsolete. That doesn't change anything from the perspective of the victim. > an open DoubleClick redirect Which is yet another example of how irresponsible advertisers are creating huge attack surfaces. From the blog they link to: bid.g.doubleclick.net/xbbe/creative/click?r1=<malicious urlencoded URL> It sounds like doubleclick is sending out the harmful redirect. Maybe they should verify URLs instead of blindly believing the query params? "msxml.domdocument" LOL > These DV certificates can help the hacker gain legitimacy with the public. How? "The public" probably doesn't even know what a DV certificate is. It doesn't look like Let's Encrypt is even involved in any of the actual problems that enable this attack. > As a certificate authority ourselves ... I guess that explains this hit piece ... /sigh/