Owned.

by @Michel gaschet #whitehat ( Mailto : me[at]michelgaschet.gp )

In a recent analysis of my past actions, i've discovered in the apache log of one of my domain name - buyed for some subdomain takeover research - multiple other forgotten msn.fr subdomain, linked to subdomain of "instant-business.co.uk" (registered around february 2016 for the subdomain takeover PoC of "geneve2006.automobile.msn.fr", reported to the MSRC).
So, yeah, one year after one subdomain takeover of MSN.FR, i've able to do the exact same act on the exact same domain name and get 27 subdomains of multiple MSN european site, simply by reading my apache log .

Actually, the list of subdomains under my control is:
tokyo.automobile.msn.fr
tokyo.cars.msn.fr
frankfurt.automobile.msn.fr
frankfurt.cars.msn.co.uk
geneva2006.cars.msn.co.uk
geneva.cars.msn.co.uk
tokyo.cars.msn.co.uk
geneva2006.motor.msn.es
frankfurt.motor.msn.es
tokyo.motor.msn.es
tokyo.cars.msn.es
frankfurt.auto.msn.be
geneva2006.auto.msn.be
tokyo.cars.msn.be
tokyo.cars.fr.msn.be
frankfurt.automobile.fr.msn.be
geneva2006.automobile.fr.msn.be
frankfurt.cars.msn.nl
tokyo.cars.msn.nl
geneva2006.cars.msn.nl
tokyo.cars.msn.se
frankfurt.motor.msn.se
geneva2006.motor.msn.se
tokyo.cars.msn.dk
frankfurt.biler.msn.dk
frankfurt.motor.msn.no
tokyo.cars.msn.no
tpi.support.msn.com (Not "instant-business.co.uk" CNAME, but an unclaimed azurewebsites.net domain on microsoft Azure Cloud)