Hijacking a Prezi Subdomain Redirect ($500)
mailroom.prezi.com concatenated the request path onto its own hostname when redirecting, so a request to /.attacker-domain sent victims to a lookalike attacker-controlled host.
Open redirect
Written off as informational until you point it at a lookalike host with a login form on it.