Site is redirecting to suspecious pages

[lilac notch]

I have pointed my root domain to Google's IP but it is now pointing to other ips which is suspicious

[vital tundra]

If your record is proxied then it will point to Cloudflare’s IPs

[lilac notch]

Yes, I am using workers as middleware. Everything was going normal from few months, what are possible reasons for it?
Currently I removed the Cloudflare nameservers.

[vital tundra]

If your name servers are not pointed at Cloudflare then it’s not a Cloudflare issue….

[lilac notch]

Sir, when the site was spoofed, that time it was pointing to Cloudflare nameservers.

I thought it's Cloudflare issue, to protect users visiting site, I removed the nameservers so that I can shut down for a while

After pointing to domain registrar nameservers everything is fine, so I think it's Cloudflare issue.

[vital tundra]

Check your audit log to see changes made. Places to check for redirects are Page Rules, Redirect Rules and Bulk Redirects

[lilac notch]

I need your help!!!

I haven't created this rule. But is is there in redirect rules.
This is the main issue. Thank you for guiding me where to check.
So, I think someone has access to my Cloudflare account or what?
What are the next steps I should take

Here is unauthorised login

[vital tundra]

You should follow https://developers.cloudflare.com/fundamentals/setup/account/account-security/secure-a-compromised-account/