We're in the Japanese celebrity gossip site business now.
dev-docs.trackjs.com had an A record pointing at a DigitalOcean IP we gave up years ago. Some jerk got the IP, got a Let's Encrypt cert via HTTP-01, and hosted SEO spam on it. Google Search Console told us before our own CT search did, because CT alerts were still "coming soon." They're live now, and this is why. Covers dangling DNS, why plain CAA wouldn't have helped, and the RFC 8657 record that would.
https://www.certkit.io/blog/dangling-dns-subdomain-takeover
Source: r/certkit · by /u/certkit