Comment by kccqzy

Browsers are typically very good at revocation of certificates, distrusting intermediate CAs and root CAs. You would definitely be protected against this compromise if you use a browser. Command line tools less so. Try this curl one liner

    curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'

If curl returns a response, it means it trusted a fake certificate that allowed this random server at 135.181.235.221 to impersonate google.

Thanks to mastodon user [email protected].