Wow this is a really detailed overview. I discovered something similar myself late last year. tsn.ca (large canadian sports broadcaster) had a subdomain taken o

Wow this is a really detailed overview. I discovered something similar myself late last year. tsn.ca (large canadian sports broadcaster) had a subdomain taken over and they used the SEO spam strategy. The subdomain was a azure address, so I figured TSN deleted the azure app but forgot to remove the DNS redirect to the internal azure URL. I never figured out what the attackers were using this for and when I checked recently the subdomain had been recovered. (checkin.tsn.ca for anyone curious, it will still appear in google)