Very common attack. It's called a subdomain takeover.