Ars technical ( arstechnica.com/security/202… ) also came in to cover the ccTLD hijack of .gh, .sl, and .as I had posted about yesterday. The most important part of the article, including Chrome’s recommendation for continuous CT monitoring. Crosslayer Labs has an industry-leading solution for providing this type of monitoring. We also correlate CT alerts with other key infrastructure events like the root-cause DNS changes associated with this attack. Everybody needs to be doing this monitoring now to protect themselves from infrastructure attacks that exist outside their network perimeter. Also, as a treat, because it really does matter, I wanted to share the actual list of affected domains (not just vague references to big brands), courtesy of Wayne Thayer's (Fastly) moz-dev-security-policy post: amazon[.]com[.]gh coca-cola[.]com[.]gh destco[.]com[.]gh ghana[.]gov[.]gh google[.]com[.]gh huawei[.]com[.]gh mtn[.]com[.]gh nike[.]com[.]gh oracle[.]com[.]gh rent[.]com[.]gh shell[.]com[.]gh unisec[.]com[.]gh whatsapp[.]com[.]gh youtube[.]com[.]gh airbnb[.]sl allianz[.]sl amazon[.]sl apple[.]sl bmw[.]com[.]sl canva[.]com[.]sl canva[.]sl cisco[.]sl coca-cola[.]sl cocacola[.]sl cybersecurity[.]gov[.]sl ebay[.]com[.]sl ebay[.]sl fanta[.]com[.]sl fanta[.]sl gemini[.]com[.]sl google[.]com[.]sl google[.]sl gucci[.]sl honda[.]com[.]sl honda[.]sl instagram[.]sl interpol[.]sl logitech[.]sl mercedes-benz[.]sl microsoft[.]sl netflix[.]com[.]sl netflix[.]sl nike[.]com[.]sl panasonic[.]com[.]sl panasonic[.]sl paypal[.]sl reddit[.]sl rolex[.]com[.]sl sierraloaded[.]sl starlink[.]com[.]sl starlink[.]sl tiktok[.]sl unesco[.]sl unhcr[.]sl xvideos[.]sl yahoo[.]sl youtube[.]com[.]sl youtube[.]sl