We accidentally hosted a Japanese celebrity gossip site on our own domain.
Subdomain takeover from a forgotten A record. The cert came from Let's Encrypt in minutes because HTTP-01 trusts whoever answers at the IP. This one was SEO spam, but the same foothold does phishing, reads parent-domain cookies, and slips through *.domain CORS and CSP allowlists. What works, zone audits, CAA with accounturi (over 99% of CAA records don't bind an account), and CT log alerts.
https://www.certkit.io/blog/dangling-dns-subdomain-takeover
Source: r/pwnhub · by /u/certkit