Cloudflare Launches Account Abuse Protection Dashboard for Investigating Suspicious Logins

Summary

Cloudflare introduced an Early Access dashboard that uses hashed account identifiers and login/signup history to help teams investigate suspicious activity, including credential stuffing, and decide on responses such as account recovery or WAF challenges.

Key points

• The dashboard aggregates login and signup activity, including account, IP address, device, country and ASN signals, to help teams identify suspicious patterns.
• Analysts can filter accounts by signals such as failed logins, leaked credential matches and the number of observed IP addresses, then review individual account event histories.
• Cloudflare says a leaked-credential match is an investigative lead, not confirmation that an account was compromised.
• Customers can use a Hashed User ID in a WAF rule to challenge or block future requests associated with that identifier.
• Two new roles separate dashboard access from access to account-level PII; the PII role is also required to create or update Logpush jobs containing PII.
• The dashboard is initially available to Account Abuse Protection Early Access customers; Bot Management Enterprise customers can request access.

Vendors

Products