My Cloudflare account was hacked? How it happen?


#1

Hi!
I have some domains in my cloudflare account, and today, DNS “A” record was changed, but not by me. And my site was down about 30 minnutes. Audit logs has no any records. Community Team, can you explain what’s happened?


#2

Hi @olegkravec97, you’ll want to login and contact support, if the changes are not visible in the audit logs, the community team won’t see them, either. I do see a change today to the A record, but based on IP of the user, the change today was you shifting it back. But, like you said, nothing else.


#3

X = my server
Always my domain was linked to X server.

In Audit logs:
Today my domain was set from 162.255.119.244 to X (by me, because site was linked to fake server)

But there is no any record where for my domain was set 162.255.119.244 IP

How it happened?


#4

That’s the question I want support to dig into; when you have the ticket number, please share it. In the meantime, if you’ve not already, please change your password, rotate your API key and think about turning on 2FA.


closed #5

This topic was automatically closed after 30 days. New replies are no longer allowed.