It is a malicious tactic used to build an infrastructure. First, the domain’s credentials are stolen and gathered. Then, after entering into the domain’s account, subdomains are created to redirect the traffic to malicious servers. All this happens without the owner’s knowledge, remaining undetected and bypassing the reputation-based filters.