A lot of windows are small and temporary. In this case the attacker could have served anything out of the S3 bucket and conducted full blown phishing (google.a

A lot of windows are small and temporary. In this case the attacker could have served anything out of the S3 bucket and conducted full blown phishing (google.ar, coinbase.ca), and generated valid certificates. It's a big deal the order of operations here and the risk MarkMonitor introduced to all their clients.