1. Someone tries to visit a brand's terminated or moved website. 2. The subdomain instead points to a replacement website created by hackers. 3. Hackers can use this position to exploit the user.