Domain Reflection is a thing, load a webpage on domain www.example.bad with low DNS TTL, then repoint it to common IPs for management interfaces, make AJAX call

Domain Reflection is a thing, load a webpage on domain www.example.bad with low DNS TTL, then repoint it to common IPs for management interfaces, make AJAX call. Of course a lot of routers try to filter it but it works in a surprising amount of installs to this day. Another entry point could be other devices in your network that have been taken over to some extend (or maybe even an app on your phone).