Look for takeover
Subdomain Takeover Lepus has a list of signatures in order to identify if a domain can be taken ...