Subdomain spam being added but cant find root

I received multiple emails this morning from google search console that new subdomains were added to my site. They are all spam sites. Our website is shopify, our url was purchased in go daddy but our hosting and DNS is cloudflare. When I go into my DNS, I dont see these subdomains anywhere. Any idea how to remove them?

website is runpacers dot com

example of spam site is slot5k dot runpacers dot com (screenshot attached too if you dont want to click the link).

You have a CNAME wildcard * record. So querying anything redirects to your Shopify IP…

dig +short

Delete that and it will stop. Note that any subdomains that are not defined (maybe www and so on) that you want to work will need to be entered as individual CNAMEs (or A) records.

1 Like

Thank you for your help!

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.