1. Someone tries to visit a brand's terminated or moved webiste. 2. The subdomain instead points to a replacement website created by hackers. (3. Hackers can use this position to exploit the user.