What it looks like
A subdomain on your domain has a CNAME pointing at a cloudapp.azure.com or azurewebsites.net target, and loading it returns Microsoft Azure's unclaimed page rather than a working site. The visible signature is text along the lines of "404 Web Site not found".
Both signals are needed. A CNAME pointing at Microsoft Azure is completely normal when the service is in use. It only matters when the target is no longer claimed.
Why it can be taken over
Deleted Azure App Service and Traffic Manager names are released and can be claimed by another subscription. Azure is one of the most frequently exploited providers for this because names are easy to reclaim.
What an attacker gets
- Content served from your subdomain, on your domain, usually with a valid certificate Microsoft Azure issues automatically.
- A phishing address that passes every check a cautious person would run, because it genuinely is your domain.
- Access to any cookie your main site scopes to the parent domain, which can include session data.
How to fix it
Remove the DNS record. If the service still exists under a different name, update the target rather than leaving the old one.
Full removal steps for any DNS provider are in the dangling record guide.
Stopping the next one
These appear whenever a hosted service is trialled and dropped, so one cleanup does not settle it. The habit worth building is deleting the DNS record in the same sitting as the cancellation, because those are separate actions and only one is on anyone's mind.