That's not necessarialy a sign of the site being compromised, I've had that happen to my own domains by: 1. Host an application on some VPS with a static IP on

That's not necessarialy a sign of the site being compromised, I've had that happen to my own domains by: 1. Host an application on some VPS with a static IP on a domain. 2. Destroy the VPS server but don't change the domain entry. 3. Boom, domain now seems to be hosting porn or other random stuff eventually as the IP in the A record gets used for other things.