Cloudflare DNS Hacked?

[johnpoz]

What is the name of the domain?

Texas Metal Works

What is the issue you’re encountering

Somehow someone added a subdomain to our DNS entries, and it was definitely not us! I can obviously delete the entry, but I need to understand how it’s even possible that this occurred.

What steps have you taken to resolve the issue?

Added 2 factor authentication. Otherwise haven’t done anything yet.

What are the steps to reproduce the issue?

The subdomain is still live in my attached screen capture for now.

Screenshot of the error

[sjr]

Check your audit log for details of when and who added the record…
https://dash.cloudflare.com/?to=/:account/audit-log

[johnpoz]

Thanks sjr! I didn’t know where that log was, but I had to go back many months to find it! However I did locate the entry, so we’ll get it taken care of now. Appreciate the pointer!!!