Cloudflare ended up getting listed as authoritative DNS in its own DNS resolver (even though the registrar's records were supposed to be authoritative)
The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account
Took nearly 3 days to claim the malicious Cloudflare account via password resets to my actual email address and enable 2FA on it to my authentication tools
Took another week+ to delete all attempted DNS registries and get Cloudflare to not recognize themselves as authoritative DNS resolution for the domains
And over a month for tech "support" and "legal" to finally get around to responding to my complaints basically saying, "you should have created an account with us with that email so no one else could try to steal it"
This sounds like they had your password?
Like, when you are CF big you can't just start resolving domains however you feel because folks use your DNS service.
free markets!
/s
But Cloudflare still let them start making DNS entries
Cloudflare (at least at the time) would let you create an account and start doing stuff without verifying you actually owned the email address
Fat-finger? bob[at]bob[dot]com to bon[dot]com? No worries
Enter my email instead of yours? Go for it
It's just a login...right?