Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans

This post introduces Cloudflare Account Abuse Protection, a new suite of capabilities designed to prevent fraudulent attacks from bots and humans. Key technical contributions include: 1. **Disposable email check**: A binary field to detect users signing up with disposable email addresses, commonly used for promotion abuse and fake account creation. This allows for rule-based enforcement, such as blocking or challenging such signups. 2. **Email risk**: A tiered risk assessment (low, medium, high) based on email patterns and infrastructure, enabling customers to express their tolerance for risk and friction at account creation. 3. **Hashed User IDs**: Per-domain, cryptographically hashed identifiers generated from usernames. These provide better insight into suspicious account activity and enable mitigation at the account level, rather than solely relying on IP addresses. This shifts defense strategy to the account level, moving away from a 'whack-a-mole' approach with rotating IPs and residential proxies. These features build upon existing capabilities like leaked credentials detection and account takeover (ATO) detection IDs, enhancing the layered defense against account takeover and other malicious automated attacks.