Skip to content
Cloudflare Docs

Account takeover detections

Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using custom rules, rate limiting rules, and Workers.

Detection IDDescription
201326592Observes all login failures to the zone.
201326593Observes all login traffic to the zone.
201326598Sets a dynamic threshold based on the normal traffic that is unique to the zone.

When the ID matches a login failure, Bot Management sets the bot score to 29 and uses anomaly detection as its score source.

Challenges for account takeover detections

Cloudflare's Managed Challenge can limit brute-force attacks on your login endpoints.

To access account takeover detections:

  1. Log in to the Cloudflare dashboard ↗, and select your account and domain.
  2. Go to Security > WAF.
  3. Under Custom Rules, select Create rule.
  4. Fill out the form using Bot Detection IDs along with other necessary information.
  5. Select Save as draft to return to it later, or Deploy to deploy the rule.
Rule example
(any(cf.bot_management.detection_ids[*] eq 201326593))

Limit logins with account takeover detections

Rate limiting rules can limit the number of logins from a particular IP, JA4 Fingerprint, or country.

To use rate limiting rules with account takeover detections:

  1. Log in to the Cloudflare dashboard ↗, and select your account and domain.
  2. Go to Security > WAF.
  3. Under Rate limiting rules, select Create rule.
  4. Fill out the form using the Custom expression builder and cf.bot_management_detection_ids along with other necessary information.
  5. Select Save as draft to return to it later, or Deploy to deploy the rule.