I took a look today at a domain that is expiring soon. We shut down everything associated with the domain a few months ago (the DO droplet and the cloudflare record).
However, we left the name servers pointing to cloudflare at our registrar.
When accessing the domain today, I noticed that it was redirected to various spam sites. Upon further inspection it looks like the DNS records were changed. There was a CNAME entry that was causing this redirect.
Is this some sort of security vulnerability? I can't imagine Cloudflare or our registrar would change the records to this spam domain themselves. I'm at a loss for how this could possibly occur.