Subdomain takeover
Takeover of a subdomain whose CNAME points to an unpaid service — the attacker registers the service and takes control.
blog.foo.com → foo.cloudapp.net no longer in use. The attacker creates a new Azure account with the same name → owns blog.foo.com. A bug-bounty winner in many large companies. Defences: clean up "dangling" DNS records when services are decommissioned.