They do require proof of ownership, but it's recently become common to support validation by proving that you control the domain or web site being validated so

They do require proof of ownership, but it's recently become common to support validation by proving that you control the domain or web site being validated so that the proof is purely electronic, e.g.: https://www.godaddy.com/help/verify-domain-ownership-html-or-dns-7452 https://www.godaddy.com/help/verify-domain-ownership-html-or... In a case like this, the attackers had sufficient control to pass those kinds of checks - although people are saying they didn't do that, and just relied on enough users clicking through the certificate warnings.