Websites aren’t just applications that touch Port 80 anymore. Services like Hotmail, Yahoo Mail, and Gmail all have taken a technology that typically has nothing to do with Websites. Attackers also are successfully using these functions to send out spam. We can no longer think of Web applications as being stand-alone. They are far too complex now. Today’s apps are not autonomous, and building threat models that exclude the vulnerabilities introduced by out-of-band services is a dangerous practice.”]
Source: https://www.darkreading.com/attacks-breaches/out-of-band-dangers