Websites removed from account, but not by me. What happened?

In our account, a number of websites were added because we are/were in the process of having Cloudflare do the DNS for these websites.

All of a sudden, these three websites were removed, but not by a person (no IP related in the audit log) entry and certainly not by us. It was done by the ‘main’ account which i manage. I certainlly did not login to cloudflare at that moment as well by the way. Next to that, there is some vague tls_settings_deployed entries.

See Audit log entries below. Does anybody know what happened here? Our main domain is blurred.com, that is still active luckily.

2024-03-04T11:01:27Z b6276763-41ea-43f9-a647-09897c30f673 tls_settings_deployed TRUE system 1 18bebd688d4c575d40b78913d2afd49b zone 2c78120464632e7e718c8927c53c9899 {"zone_name":"made-up-online"}
2024-03-04T11:01:01Z fb22ebb0-dffa-514e-8642-69b7e3bce289 delete TRUE user e8f8c671892216f367f075653e83d6cd ::1 18bebd688d4c575d40b78913d2afd49b zone 2c78120464632e7e718c8927c53c9899 {"actor_email":"[email protected]","zone_name":"made-up-online"}
2024-03-04T10:57:26Z 47081ca8-77eb-409e-b890-fb82ccdd3067 tls_settings_deployed TRUE system 1 18bebd688d4c575d40b78913d2afd49b zone 70d6d0da367ca0b21ee7f29cac123fe6 {"zone_name":"made-upservice"}
2024-03-04T10:56:40Z 65810acc-d2e8-56f7-a746-2cd5134495b1 delete TRUE user e8f8c671892216f367f075653e83d6cd ::1 18bebd688d4c575d40b78913d2afd49b zone 70d6d0da367ca0b21ee7f29cac123fe6 {"actor_email":"[email protected]","zone_name":"made-upservice"}
2024-03-04T10:44:54Z 2ad1fc44-7738-405a-983d-cf78199f73c3 tls_settings_deployed TRUE system 1 18bebd688d4c575d40b78913d2afd49b zone 461434a1149dfef8327471faa8f29058 {"zone_name":"made-up-cloud"}
2024-03-04T10:44:53Z fad6d0cb-81d5-5983-9fa2-df13743167ec delete TRUE user e8f8c671892216f367f075653e83d6cd ::1 18bebd688d4c575d40b78913d2afd49b zone 461434a1149dfef8327471faa8f29058 {"actor_email":"[email protected]","zone_name":"made-up-cloud"}

That domain is not using Cloudflare…
https://cf.sjr.org.uk/tools/check?d741a466c42743afb35078be04b524cf#dns

The other sites, did you add those to Cloudflare but left them pending? If they don’t complete being added to Cloudflare then they are deleted after 28 days…

Otherwise you can check your account hasn’t been compromised…

Hi SJR,

Th for your quick reply. The domain name is not really blurred.com, i changed the real domain name with the term blurred. Just like i changed an element of the other domains with ‘made-up’. Our main domain is on cloudflare, no worries.

Regarding the 28 days; that could just as well be. The process of gaining control has been an annoying one, as the person marked as owner at the previous regstrar does not respond to email anymore. I will check with the person responsible.

Please dont use real domain names that are not yours for obfuscation purposes. There already exist reserved names such as example.com for that purpose. This prevents abuse of someone else’s domain and avoids sending volunteers on wild goose chases.

If you secure the necessary access to the domain registrar before adding the domain to Cloudflare, that should help with completing the activation within the allotted timeframe.

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.