I see events in Audit log I didn't create

I got an email from CloudFlare telling me my account was accessed from another ip. I changed all passwords and setup 2fa. I checked audit log and I see 10-15 requests made using the API interface yesterday. Of course I didnt do them. Here is a screenshot:

Is this normal?

Ccharmander I got an email from CloudFlare telling me my account was accessed from another i...

Chaika•11/5/24, 3:09 PM

Normal. See how it's saying the user was Cloudflare and not you? You'd be generally looking for changes which your user did, when looking for comprimise

Chaika•11/5/24, 3:09 PM

it's just renewing your workers.dev cert looks like

CChaika it's just renewing your workers.dev cert looks like

charmanderOP•11/5/24, 3:10 PM

Phew...but then why did they send me a suspicious activity email at all lol

Ccharmander Phew...but then why did they send me a suspicious activity email at all lol

Chaika•11/5/24, 3:11 PM

They send you an email that somehow signed in from a new IP, sounds like what you're describing. It doesn't mean they did anything (or maybe just didn't have a chance to do so), but if you didn't recognize the login/ip changing credentials/setting up 2fa is what you should do anyway

CChaika They send you an email that somehow signed in from a new IP, sounds like what yo...

charmanderOP•11/5/24, 3:11 PM

All right thank you very much mate!

I see events in Audit log I didn't create

Similar Threads

Similar Threads

Similar Threads