Cloudflare takover and 2FA lockout - >48h

What is the name of the domain?

www.carbonclick.com

What is the issue you’re encountering

Website down

What steps have you taken to resolve the issue?

repoint the DNS using AWS Route 53 to another server

What feature, service or problem is this related to?

DNS records

What are the steps to reproduce the issue?

Website is down http://www.carbonclick.com/

Hello Community,

We’ve been dealing with a takeover and redirect issue for more than 48h now and have been working to resolve it without luck. It seems someone with unathorized access got into our cloudflare, repointed the DNS and locked the rest of the team out. Unfortunately, we’ve not been able to get through to phone support despite our efforts and are currently awaiting a callback. (Case #01439732)

We’re unable to do the automated recovery online since we don’t have access to the domain. Any assistance to escallate the case would be much appreciated

please call +6421333857 or or +642108383050 to help us regain access to the account

Best regards,
Jan

Phone support is for Enterprise plans. If you’re an Enterprise customer, please reach out to your account rep, and they can help you with this.

Thanks for the quick reply Sdayman. We’re a paying customer on the Pro plan, not Enterprise, so it sounds like phone support isn’t an option for us - happy to upgrade to Enterprise, I just tried calling and the call failed, will try again shortly. But if we’re not on Enterprise, does that really mean our only path forward is waiting for Case #01439732 to make its way up the ticket queue? We’ve been locked out for over 48 hours now, and it’s hitting our business hard.

To give you more context: we’re trying to bypass the hijacked Cloudflare account by reclaiming control of our domain through AWS Route 53. We’ve set up a new hosted zone there and updated the nameservers at our registrar (AWS Route 53 is also our registrar), but Cloudflare’s nameservers (brianna.ns.cloudflare.com, vick.ns.cloudflare.com) are still showing as authoritative with a 1-day TTL. Even after switching to Route 53 nameservers, DNS propagation isn’t kicking in - public DNS servers like Google’s (8.8.8.8) either fail or point back to Cloudflare. We’re stuck because we can’t shake Cloudflare’s grip on the domain.

Is there any way to escalate this with Cloudflare support outside of phone access? The automated recovery process is a dead end since we don’t control the domain anymore, and the standard ticket wait time feels like an eternity given the situation. If anyone from Cloudflare staff is watching this thread, we’d be incredibly grateful for a nudge to get this moving faster- please call +6421333857 or +642108383050 to help us regain access.

Appreciate any advice or insights you or the community can share!

Best regards,

Jan

At the moment it looks like no nameservers are being returned at all for your domain.

.

As you’re using Route53 as registrar and for setting your nameservers, you may want to reach out to AWS support instead, as this does not appear to be an issue on Cloudflare’s side.

1 Like

Message from my Developer:

According to the DNS query below, one issue appears to be Cloudflare nameservers are still presenting as authoritative in the DNS system with a TTL of 1d.

Is there any possibility to purge/remove these entries from brianna.ns.cloudflare.com and vick.ns.cloudflare.com to aid propagation of our NS records through the DNS network?


; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> @brianna.ns.cloudflare.com carbonclick.com NS +ttlunits
; (6 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8372
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;carbonclick.com.		IN	NS

;; ANSWER SECTION:
carbonclick.com.	1d	IN	NS	brianna.ns.cloudflare.com.
carbonclick.com.	1d	IN	NS	vick.ns.cloudflare.com.

;; Query time: 3 msec
;; SERVER: 108.162.192.245#53(brianna.ns.cloudflare.com) (UDP)
;; WHEN: Tue Mar 25 17:52:10 NZDT 2025
;; MSG SIZE  rcvd: 99
```

That shouldn’t matter. Route53 is the domain registrar and DNS provider. That’s what determines which name servers are authoritative. Just because some other DNS provider thinks it’s in charge doesn’t make it so.

1 Like

@janicz Double-check that your DNSSEC is disabled on your domain at Route53, as that may be the reason why no nameservers are being returned by your domain. Else I would still suggest contacting AWS/Route53 support, as this is 100% not an issue on Cloudflare’s side.

1 Like

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.