GH Domain Name Incident Report

Reference
INC-12-09-2026-GH-PUBLIC
Incident date
Date of report
Case
Unauthorized DNS Modifications
Author
Ghana Dot Com .GH Registrar

Description

A suspicious web login activity alert triggered an immediate investigation into suspected unauthorized access to the hosted registrar system at 11:05 AM.

Further technical investigations and analyses established the following:

  1. Authentication logs confirmed successful logins to the hosted registrar system by an unauthorized actor on 22 September 2026.
  2. Audit and registrar records confirmed unauthorized changes affected 33 domain names between 9:34 AM and 11:19 AM.
  3. Nameservers were changed to joan.ns.cloudflare.com and peyton.ns.cloudflare.com.
  4. Compromised accounts were recovered by 12:57 PM on 22 September 2026, and the integrity of the registry data was restored at 2:18 PM on 22 September 2026.
  5. Additional security measures were also implemented to strengthen the system.

Impact Analysis

  1. The nameserver records of the affected domains were changed without authorization to point to the following nameservers: joan.ns.cloudflare.com and peyton.ns.cloudflare.com.
  2. The unauthorized DNS changes resulted in users visiting affected domain names being redirected to a defaced homepage.
  3. The impact varied among users of the affected names, with some continuing to access the legitimate website while others were temporarily redirected to the defaced page.
  4. The unauthorized actors obtained new, valid domain-validated SSL/TLS certificates for the affected domain names through a certificate authority.

Actions Taken

The following containment measures were implemented to restrict unauthorized access and prevent further malicious activities, including but not limited to the key actions detailed below:

  1. Credentials for all user accounts were updated, and their Two-Factor Authentication (2FA) configuration was reset.
  2. All user account roles and permissions were revoked.
  3. The IP addresses associated with the malicious activities were blocked at the firewall level.
  4. Affected clients have been engaged and incident report shared.
  5. Continuous monitoring of the registrar system.
  6. Continue to monitor the evolution of the incident.

Remediations

  1. The unauthorized Nameserver (NS) records of the affected domains were restored to their legitimate values between 12:57 PM and 2:18 PM on 22 September 2026.
  2. Additional security controls were implemented regarding checks on the integrity of the database and the zone files.