I'm replying to my own comment as I've had some new thoughts on how these attackers could have pulled it off. 1. Attacker registers hundreds/thousands of free

I'm replying to my own comment as I've had some new thoughts on how these attackers could have pulled it off. 1. Attacker registers hundreds/thousands of free CF accounts. 2. Each account gets assigned random CG nameservers (some dupes obviously) 3. Attacker than loads the assigned nameservers into a tool that looks for domains using those nameservers. 4. Attacker monitors those domains for accidental expirations. 5. Once expired, attacker adds domain in the CF account that matches the existing nameservers. 6. Once renewed domain comes back online, attacker controls DNS at Cloudflare.