Hijacking a Prezi Subdomain Redirect ($500)
mailroom.prezi.com concatenated the request path onto its own hostname when redirecting, so a request to /.attacker-domain sent victims to a lookalike attacker-controlled host.
Phishing
What an open redirect is actually worth. A hostname the victim trusts in front of a page you wrote.