In early October 2026, reports of Ukrainian drone strikes affecting Yandex data centers raised a question: would infrastructure disruption leave a visible signature in public certificate issuance data?
Examining certificate transparency trends, we observed a notable increase in .ru's share of global certificate issuance in the days following the reported attacks—not the straightforward decline one might initially expect.
This correlation does not establish that the attacks caused the increase. But it illustrates why certificate transparency is a useful intelligence source: issuance patterns can reveal infrastructure changes worth investigating further.
An unusual shift in certificate issuance revealed how DNS wildcarding and automated HTTPS can create an enormous amount of misleading security telemetry.
For some time, .ph—the country-code TLD for the Philippines—had consistently appeared among the ten busiest TLDs in our view of newly observed TLS certificates. Then, around August and September 2026, it fell sharply. By October, it no longer appeared among the top twenty.
That was unusual. TLS certificate issuance is a global, high-volume activity. A TLD does not ordinarily fall that far in the rankings without a meaningful change in the infrastructure generating those certificates.
Had Philippine websites stopped using HTTPS? Had a certificate authority changed its policies? Or had something been inflating .ph issuance in the first place?
Our investigation led to a much more interesting explanation: certificates were being issued for domain names that were not even registered.
Executive summary
The signal: NOB.center's TLD issuance rankings showed .ph falling from the top ten to outside the top twenty within roughly one to two months.
The mechanism: Public reporting documented .ph DNS behaviour that directed otherwise unregistered names to a domain-parking service, enabling automated HTTPS certificate validation.
Independent corroboration: A separate CT-monitoring dataset recorded a collapse in .ph-family lookalike names in September 2026, from thousands per week to fewer than 200.
The lesson: A publicly trusted certificate confirms a form of domain control during validation. It does not prove the domain was registered, that the website is legitimate, or that the certificate represents a newly deployed business service.