“MarkMonitor does not have a way of disclosing security issues, which inhibited reporting this to them in a timely manner.”
MarkMonitor protects big brands’ domains for a living. For an hour, more than 62,000 of them pointed at unclaimed S3 buckets anyone could grab, including google.ar and coinbase.ca. That is long enough to get a TLS certificate. The company has no security contact and didn’t answer. Brand protection, as a service.