Follow the Thread: A New Dashboard to Investigate Account Abuse
Hi everyone, it's Shii-chan! Today it's a dashboard for investigating fraudulent logins and signups.
Cloudflare Blog
blog.cloudflare.com
What was announced?
The Cloudflare Blog introduced the new Account Abuse Protection dashboard. Fraudsters are increasingly using AI to bypass stateless security checks, so this uses stateful analysis and edge-generated Hashed User IDs to help teams investigate and block account abuse.
What changes
The dashboard supports a layered investigation:
- Overview: login and signup volume, account counts, unique IPs, devices, and geographic and ASN breakdowns
- Filtering: narrow down by criteria such as failed login counts and leaked credential matches
- Individual account analysis: event histories, success rates, and network and device associations
- Event tracking: timestamps, Ray IDs, and mitigation records for each login or signup event
Dive Deep
A Hashed User ID is made by cryptographically hashing a customer-provided identifier (email, username, or phone) into a privacy-preserving anchor for the account. Behavioral, network, and device signals gathered at the edge accumulate on that anchor, giving context for the account's typical behavior without exposing raw PII.
The post walks through a credential stuffing investigation: spot anomalies, filter high-risk accounts, examine individual account details, and add WAF rules to block compromised identifiers.
Availability and access:
- Currently available to Early Access customers; Bot Management Enterprise customers can sign up for Early Access
- Two new roles: "Account Abuse Protection" (dashboard access) and "Account Abuse Protection PII" (viewing sensitive account details)
Wrap-up
- A new Account Abuse Protection dashboard for investigating account abuse
- Hashed User IDs build behavioral context without exposing raw PII
- In Early Access, open to Bot Management Enterprise customers
A good fit for fraud teams fighting fake logins and signups!
