My domain name registar was kicking dicks for few weeks and I was not able to renew my domain, so it was in HOLD state. During this time Cloudflare detected it’s not using CF dns servers (please, check WHOIS - it was the same there, this registrar do not change NS to something like ns1.expired.com). Soon CF deleted a zone from the system.
Just now I renewed domain and see CloudFlare DNS servers are returning REAL IP ADDRESS of the server. This is a huge DATA LEAK that should be fixed, IMHO