My account was hacked

General
1

What is the name of the domain?

All my domains

What is the issue you’re encountering

Missing domain and debit from bank

What steps have you taken to resolve the issue?

Help!!

I think my account was hacked. I have been speaking to support but they have not been helpful. How can I speak to a real human?

It was initially a case of my domains missing with audit log showing I have just created my account.

Now I just received a debit alert from cloudflare without buying anything.

Please how can I speak to a real human that can help? Customer support response is sounding like a robot.

2

Telephone support is only available to Enterprise users requiring emergency support. Otherwise you will need to work through the ticket as the community can’t see into your account.

This just sounds like you’ve created a new account rather than logging into your original account. If you can give some of the affected domains then it is easier to check.

3

Thanks.

This is the same response I’ve been getting but it’s false.
I strongly believe my account was compromised and improperly reassigned. Below is a timeline of events and supporting details:

Timeline of Events
April 3, 2025 10:10 UTC – I received a security alert email for login from new IP:
Login from IPv6 address 2a0f:6580:108:f13a:5cb9:eba8:8b48:cbb8 (I did not initiate this).

April 10, 2025 08:28 UTC – I did a password reset. Upon successful login, I found:

My account looked completely reset.
Audit logs showed the account was “created” on April 9, despite years of prior usage.
My nameservers and account ID had changed.
All previously added domains were missing.
Domain I purchased via Cloudflare was no longer accessible.

Critical Red Flags
The login on April 3 from an unknown IP (masked IPv6) suggests a potential breach.
Audit logs show new account creation on April 9, yet the same email was used.

The last support agent confirmed that the domain I bought through Cloudflare now shows a different email address, while my email is still listed as a contact. This clearly indicates account tampering, not user error.

What I’m Requesting
I am urgently requesting a full internal investigation, including:

Historical logs of:
Domain purchase and original account ownership.
Email change history for the compromised domain.
IPs and geolocations tied to access around April 3–10.
Restoration of access to the domain purchased via Cloudflare.

I have attached screenshots of the Cloudflare login alerts as evidence in my earlier tickets. This is not a case of a forgotten account2 or a new account, but a case of account compromise.

I want at least an escalation to the security or account recovery team. I am available to provide further verification or evidence as needed.

4

You can only go through the ticket then. The community can’t help you other than offer a look if…

But all this…

…looks like a new account. Your audit log can’t be reset or cleared.

1 Like
5

This is a screenshot from my email from when I bought the domain. I can not buy a domain from an account before creating it. COuld it be an issue from account reset? Or an issue with sign in with google?
I have had the account since 2023, it is the only account I use.

image
image1920×1046 181 KB

6

I can see you’ve posted the same several times before - posting again won’t get a different answer. You’ll have to work through the ticket as the community can’t look into your accounts.

7

Thank you