I am trying to contact support however as the account in question has had its paid service from cloudflare removed we seem to be in the free support queue and thus not getting any response.
Last week the account in question unexpectedly had its subscriptions removed. I have checked the audit log and can see that a number of subscriptions were cancelled and changes made all at the exact same time (as in not possible by a human).
I have triple checked and billing was successful on the 1st of November confirmed both from our accounts and within cloudflare.
As we were using a significant amount of the paid features this is now causing a lot problem for our live operations.
Is there any way to actually contact cloudflare in a situation like this? I must say i am quite disappointed in CF, having a paid service that is in many ways an integral part of our online operations being suddenly halted without reason and no response from cloudflares support ticket system feels like we’re very much on our own.
Does anyone have experience contacting CF urgently? Can i @ someone on twitter etc.
Support is the best option to assist, please share your ticket number here if you open a ticket.
In most cases like this, the reason the zones disappeared is that the registration expired, nameservers reverted to the default, we detected a domain “move”, sent a message indicating the zone would be removed in a week, a week later, we removed the zone.
But, to see if that is what happened in this case, can you share the name of one of the domains in question?
The latest ticket number is #1786720 - i believe the ticket should indicate the correct domain/s - the one starting with s is the major concern.
Not sure what you mean regarding registration expired, in regards to the domain name this was renewed earlier in the year. The ICT team has not indicated receiving any email regarding any upcoming termination of services only when the services were removed.
Thank you, I see the ticket and the domains. You are correct, the domains were not moved.
But, I do see a helpdesk@ from one of your domains removed a subscription on the 6th. You may want to login, change your password and rotate your api keys if that activity is not familiar to you.
Edit - Actually, I can see this cancel action on two domains, a cancel proceeded by a sub expire for ID (*710) & ID (*709). I will kick off a private message to you to follow-up.
Are you able to communicate via email to discuss further? I was particularly wondering if there are IPs available in your logs so we can verify where the account login for the subscription removal originated. Also if any settings that were changed were all as a result of account change or if some are potentially nefarious as i cannot tell from the audit log information. And lastly, i do not have any entries visible in the audit log between the 31st of October and the 7th of November - where i would expect at least a login in that period should someone have logged in to remove the subscription. Lastly, is it possible to restore the subscription with the previous settings?