Other services will be reflected by active DNS records.
If the only DNS record points to a "Buy this domain" webpage, I think it's fair to argue that is misuse.
Doubley so if it turns out many unrelated domains are owned by and point to the same webpage, and it's just doing a js hostname thing to make it seem relevant to the current address
If they weren't using VCS, I bet they have creds embedded in the source.