&gt; gained the ability to create subdomains under a legitimate domain<p>As lots of people in this thread have already pointed out, that&#x27;s the security problem. The DNS zone that was delegated to you, then you have a responsibility to keep the &quot;squatters&quot; away.<p>&gt; Traffic to this created subdomain was protected with HTTPS<p>Good. HTTP is obsolete. That doesn&#x27;t change anything from the perspective of the victim.<p>&gt; an open DoubleClick redirect<p>Which is yet another example of how irresponsible advertisers are creating huge attack surfaces.<p>From the blog they link to:<p><pre><code>    bid.g.doubleclick.net&#x2F;xbbe&#x2F;creative&#x2F;click?r1=&lt;malicious urlencoded URL&gt;
</code></pre>
It sounds like doubleclick is sending out the harmful redirect. Maybe they should verify URLs instead of blindly believing the query params?<p><pre><code>    &quot;msxml.domdocument&quot;
</code></pre>
LOL<p>&gt; These DV certificates can help the hacker gain legitimacy with the public.<p>How? &quot;The public&quot; probably doesn&#x27;t even know what a DV certificate is.<p>It doesn&#x27;t look like Let&#x27;s Encrypt is even involved in any of the actual problems that enable this attack.<p>&gt; As a certificate authority ourselves<p>... I guess that explains this hit piece ... &#x2F;sigh&#x2F;