What it is
When a subdomain is pointed at a third-party service via CNAME and that service is later decommissioned, the DNS record often survives the cleanup. If the third-party service allows anyone to claim the previously-used name, an attacker can register blog.<yourdomain>.com on that service and serve arbitrary content that appears, to browsers, to users, to email link previews, to be first-party content from your domain.
Why it matters
A takeover-owned subdomain is the highest-trust phishing platform available: it serves a real certificate for your domain, it renders in the browser as your brand, and it inherits any implicit trust the user gives your parent domain. Attackers use them for credential-harvesting phishing, for hosting malware payloads, and for evading enterprise URL-blocklists.
The check behind the finding
nslookup old.yourfirm.caA name that points to a service you no longer use can be claimed by someone else.
Closing it
This can be closed, usually in one sitting, once the host names that point at a service nobody controls are known. The assessment lists each one with its evidence and gives the exact steps.