Source-linked reports: Amounts and outcomes come from the original reports and linked replies.
Log Explorer during a DDoS produced disputed charges of $2,199.12 and $1,018.64.
sunnydays says Log Explorer was enabled for user analytics, a competitor attack followed, and two charges of $2,199.12 and $1,018.64 appeared. The author disputes both as beyond budget, says the feature was meant to reduce costs but increased them more than a hundredfold, and requests reversal. The two amounts are kept distinct and are not summed.
What happened
- Reported cause
- Traffic spike
- Incident date
- Date not recorded
- First reported
- 2025-08-23
- Billing outcome
- Request submittedAuthor-reported
- Case progress
- Not established
- Public Cloudflare reply
- Not linked
Latest reported outcome
The author disputes both charges and requests reversal; a second exact amount of $1,018.64 is stated in the same post and is not added into the reported amount field.
View this update in the timelineOriginal sources
Each entry links to the report or reply it describes.
Case timeline
Author disputes Log Explorer charges after an attack
Open original sourceThe author reports enabling Log Explorer, suffering a DDoS, and disputing separate charges of $2,199.12 and $1,018.64.
More to read
Cloudflare Cost Guard: a read-only agent skill for runaway-billing audits
Layer Cache’s open-source agent skill, announced by Domenico (@purposelyblnk), audits a Cloudflare codebase from source alone for paths that can run up uncontrolled billable usage, and reports findings without changing code or calling Cloudflare.
An L7 DDoS pushed about 182 TB through Argo, an $18,232.50 charge.
Community user TravelTech says an April 2026 L7 DDoS attack peaking around 400k requests per second was routed through Argo Smart Routing before mitigation, generating about 182 TB of Argo usage and a disputed $18,232.50 charge. They say a billing case with attack logs was opened on April 29 and that their account executive confirmed in writing that the traffic was an attack and said finance would review, with no resolution after six weeks.
A budget alert is a horn, not a brake
@GUYUE_LGY points to Cloudflare’s Budget alerts documentation: alerts send email when spend crosses a threshold but do not pause or cap usage. Before letting AI run unattended, the author checks what actually happens at the line.