Source-linked reports: Amounts and outcomes come from the original reports and linked replies.
About 32 million unauthorized requests produced a $144.09 R2 Class A charge.
Community user xhn880911 reports an unexpected $144.09 charge for R2 Class A operations from more than 32 million unauthorized requests. They deleted the R2 resources and say a ticket could not be opened because the dashboard was stuck in a redirect loop.
What happened
- Reported cause
- Traffic spike
- Incident date
- Date not recorded
- First reported
- 2026-09-15
- Billing outcome
- Not recorded
- Case progress
- Not established
- Public Cloudflare reply
- Not linked
Original sources
Each entry links to the report or reply it describes.
Case timeline
Author reports the R2 charge
Open original sourceThe author reports $144.09 of Class A operations from unauthorized requests and says a billing ticket could not be opened.
More to read
How I keep Cloudflare under $5: where surprise bills come from
Ashish Sharma (@sarmaasis) runs several sites on the $5 Workers Paid plan and lists, product by product, the usage patterns he says quietly run up a Cloudflare bill, ending with a 12-item checklist.
mcwangcn reports $1,300 in D1 charges after a bot attack.
@mcwangcn says D1 writes previously cost over a thousand dollars and separately mentions Workers CPU charges without giving an amount. He later shares a Cloudflare bill and says $1,300 of its $3,600 came from D1 after a bot attack.
A budget alert is a horn, not a brake
@GUYUE_LGY points to Cloudflare’s Budget alerts documentation: alerts send email when spend crosses a threshold but do not pause or cap usage. Before letting AI run unattended, the author checks what actually happens at the line.