--- title: Follow the thread: a new dashboard to investigate... description: Cloudflare launched a new Account Abuse Protection dashboard, available first to Early Access customers, that helps fraud and trust-and-safety teams... canonical: https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Follow the thread: a new dashboard to investigate account abuse | daily.dev og:description: Cloudflare launched a new Account Abuse Protection dashboard, available first to Early Access customers, that helps fraud and trust-and-safety teams... og:url: https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k og:image: https://api.daily.dev/og/posts/Fhjg6uE7K.png og:image:alt: Follow the thread: a new dashboard to investigate account abuse og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Follow the thread: a new dashboard to investigate account abuse **[Cloudflare](https://daily.dev/sources/cloudflare)** · 8 min read · 0 upvotes · 0 comments ## Summary Cloudflare launched a new Account Abuse Protection dashboard, available first to Early Access customers, that helps fraud and trust-and-safety teams investigate login and signup abuse. The tool builds stateful account overviews using privacy-preserving Hashed User IDs derived from customer-configured identifiers like email or username, combined with network and device signals captured at Cloudflare's edge. Analysts can move from a population-level view of suspicious trends down to individual account investigations, using filters, event timelines, and Ray IDs to reconstruct attacks such as credential stuffing campaigns. Two new access roles separate dashboard access from PII access to limit unnecessary data exposure. Confirmed compromised accounts can be blocked via WAF rules keyed on the Hashed User ID. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a Hashed User ID in Cloudflare's Account Abuse Protection? A Hashed User ID is a cryptographically hashed, privacy-preserving, per-domain identifier that Cloudflare generates from a customer-configured login or signup field such as an email address, username, or phone number. It anchors an account's activity within Account Abuse Protection, accumulating login and signup events plus network and device signals over time to establish a behavioral baseline for that account. _Teams building account security workflows can track product updates like this one on daily.dev._ ### How can I use Cloudflare to investigate a credential stuffing attack against user accounts? Cloudflare's Account Abuse Protection dashboard lets analysts start from an account population overview, checking leaked credential match rates against clean logins (for example 2.4K leaked versus 11.7K clean in one scenario), then filter accounts by criteria like at least three failed logins, three leaked credential matches, and five unique IP addresses to narrow down accounts needing manual review. _Security engineers investigating account takeover patterns can follow fraud-tooling coverage like this on daily.dev._ ### What are the new access roles for Cloudflare Account Abuse Protection? Cloudflare introduced two new roles: Account Abuse Protection, which controls access to the fraud dashboard itself, and Account Abuse Protection PII, which controls access to additional account-level personal data such as email addresses and is also required to create or update Logpush jobs containing PII. Separating these roles lets administrators apply least-privilege access across dashboard and data export workflows. _Admins designing least-privilege access controls can keep up with platform permission changes via daily.dev._ ## Similar posts on daily.dev - [Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans](https://daily.dev/posts/announcing-cloudflare-account-abuse-protection-prevent-fraudulent-attacks-from-bots-and-humans-rrhciudwp) · Cloudflare · 0 upvotes · 0 comments - [Cloudflare Processes 10M\+ Daily Insights with New Security Overview Dashboard](https://daily.dev/posts/cloudflare-processes-10m-daily-insights-with-new-security-overview-dashboard-2asrbn7n3) · InfoQ · 1 upvotes · 0 comments - [Enterprise-grade user account protection: Protecting local user accounts for compliance and operational continuity](https://daily.dev/posts/enterprise-grade-user-account-protection-protecting-local-user-accounts-for-compliance-and-operatio-pecp1uypw) · Dynatrace · 0 upvotes · 0 comments - [Building a security overview dashboard for actionable insights](https://daily.dev/posts/building-a-security-overview-dashboard-for-actionable-insights-7lev43wwz) · Cloudflare · 0 upvotes · 0 comments - [Your sign-up form is a weapon](https://daily.dev/posts/your-sign-up-form-is-a-weapon-cwnsa8fnc) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloudflare](https://daily.dev/tags/cloudflare), [#fraud-detection](https://daily.dev/tags/fraud-detection) [View this post on daily.dev](https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Follow the thread: a new dashboard to investigate account abuse","url":"https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k"},"datePublished":"2026-10-02T13:13:46.127Z","dateModified":"2026-10-02T13:14:07.599Z","description":"Cloudflare launched a new Account Abuse Protection dashboard, available first to Early Access customers, that helps fraud and trust-and-safety teams...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a794c843c8fe0475e3f85a892296df22?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a794c843c8fe0475e3f85a892296df22?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloudflare,fraud-detection","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Follow the thread: a new dashboard to investigate account abuse"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/follow-the-thread-a-new-dashboard-to-investigate-account-abuse-fhjg6ue7k#faq","mainEntity":[{"@type":"Question","name":"What is a Hashed User ID in Cloudflare's Account Abuse Protection?","acceptedAnswer":{"@type":"Answer","text":"A Hashed User ID is a cryptographically hashed, privacy-preserving, per-domain identifier that Cloudflare generates from a customer-configured login or signup field such as an email address, username, or phone number. It anchors an account's activity within Account Abuse Protection, accumulating login and signup events plus network and device signals over time to establish a behavioral baseline for that account. Teams building account security workflows can track product updates like this one on daily.dev."}},{"@type":"Question","name":"How can I use Cloudflare to investigate a credential stuffing attack against user accounts?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare's Account Abuse Protection dashboard lets analysts start from an account population overview, checking leaked credential match rates against clean logins (for example 2.4K leaked versus 11.7K clean in one scenario), then filter accounts by criteria like at least three failed logins, three leaked credential matches, and five unique IP addresses to narrow down accounts needing manual review. Security engineers investigating account takeover patterns can follow fraud-tooling coverage like this on daily.dev."}},{"@type":"Question","name":"What are the new access roles for Cloudflare Account Abuse Protection?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare introduced two new roles: Account Abuse Protection, which controls access to the fraud dashboard itself, and Account Abuse Protection PII, which controls access to additional account-level personal data such as email addresses and is also required to create or update Logpush jobs containing PII. Separating these roles lets administrators apply least-privilege access across dashboard and data export workflows. Admins designing least-privilege access controls can keep up with platform permission changes via daily.dev."}}]} ```