Domain & sub domain auto download file...virus

I have multiple domains using Cloudflare
but today all my domains load a virus file on page load.

it only happens when I turn on the Proxied function

I tried creating the record:
A. AAA. COM → server A
B . BBB. COM → server B
C .CCC. COM → server C
but all still download virus files

I use another provider’s DNS, everything is fine.

Can anyone explain this to me?

Welcome to the Cloudflare Community. :logodrop:

Based on the symptoms you describe, it is very likely that your Cloudflare account has been compromised by an attacker.

You may want to review your account audit log and you need to issue action to secure your account. Make sure to remove any malicious redirects and consoder adding either TOTP or Yubikey MFA to your account.

2 Likes

Thank you!
I just checked it is as you said!
In “Redirect Rules” has been changed.

2 Likes

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.