It turns out I have NO droplets running. So I am not sure what is compromised. The site must be hosted on the attackers own hardware. Maybe they have my registr

It turns out I have NO droplets running. So I am not sure what is compromised. The site must be hosted on the attackers own hardware. Maybe they have my registrar (recently transferred to namecheap) or maybe they just used a stolen credit card to purchase a VPS from Digital Ocean and have just set up the CNames as my domain because they realized I have it unhosted. So my site/hardware/server has not been compromised, it does not exist. Somehow they have hijacked my domain or atleast have a site hosted at my domain.