These "dangling" subdomains typically happen when a resource is de-provisioned but the DNS entry for the subdomain is not removed in a timely fashion.
