Cloudflare Adds Account-Abuse Events to Logpush: How Proxy Teams Should Read the Signals

Cloudflare added an Account Abuse Protection Events dataset to Logpush on August 20, 2026. The dataset combines authentication context, network location, request identity, automation indicators and fraud-risk signals in one event stream. Listed fields include authentication provider, method and status; bot score; client ASN, city, country and IP; ephemeral identifier; event source and type; fraud email risk; host; JA4; request identifier; timestamp; user agent; user and email fields.

For authorized account testing, market research, ad verification and data-collection teams, the value is not that any single field gives a verdict. The value is that teams can stop treating every login rejection, challenge or 403 as a generic “proxy problem.” The new schema supports a more disciplined question: did the failure come from the route, the account state, the authentication flow, the client implementation or the application policy?

What the new dataset changes

Before a unified event stream, analysts often joined partial evidence from an identity provider, an application log, an edge-security event and a proxy gateway. That made time alignment difficult and encouraged shortcuts such as blaming the exit IP whenever a remote workflow failed.

The new dataset does not remove the need for those other logs. It provides a common account-abuse event that can be correlated with them. In practical terms, it lets an authorized operator compare five evidence families:

• Authentication: identity provider, method and result;
• Network: client ASN, country, city and IP;
• Client: user agent and JA4 fingerprint;
• Risk: bot and fraud-email signals;
• Outcome: event source, event type, host, timestamp and request identifier.

Cloudflare also added fields to other Logpush datasets in the same update, including request-signature categories for firewall and HTTP-request events. That broader context reinforces an important design principle: security outcomes should be read as correlated events, not as isolated status codes.

A score is evidence, not an explanation

A bot score or fraud-risk value is one input to a policy decision. It is not a portable label that explains every failure, and it should not be used as a proxy-vendor quality score.

Suppose a controlled login succeeds over one route and fails over another. The route may matter, but several other variables may have changed at the same time: address family, DNS resolver, TLS fingerprint, client build, identity-provider branch, account state, cookie freshness, geography policy or request timing. A useful investigation holds those variables constant and changes one dimension at a time.

Similarly, a low-risk event does not prove the route is healthy. A proxy can still have tunnel failures, unstable sessions, DNS leakage or excessive latency. Account-abuse telemetry and transport telemetry answer different questions.

Build a three-layer diagnostic model

Use three layers so that account signals do not overwrite network evidence.

Layer 1: route health

Record whether the client reached the intended proxy gateway, which address family was used, where DNS resolved, whether the tunnel and TLS handshake completed, the exit region, session identifier and timing. These fields describe transport quality.

Layer 2: identity and application state

Record the approved test account, authentication method, identity provider, documented application step and expected result. Store only a pseudonymous account reference in the analysis table. Secrets, cookies and one-time codes must never enter telemetry exports.

Layer 3: security and outcome context

Join the Account Abuse Protection event using a request identifier or a narrow timestamp window. Compare event type, authentication status, bot score band, fraud-risk band, ASN, country, user agent and JA4. Keep the raw provider event under restricted access; use minimized derived fields for routine analysis.

This model prevents a security decision from being reported as a transport outage, while still allowing route attributes to be tested as one possible factor.

A safe test matrix

Start with a small, authorized fixture and concurrency one. A useful matrix contains:

Run a direct control only when the system owner permits it. Do not rotate through many exits, accounts or identities. High-cardinality rotation makes the result harder to interpret and can look like account abuse itself.

Privacy controls belong in the design

The new dataset can contain direct or linkable identifiers. Treat privacy engineering as part of the collection plan, not as cleanup after export.

1. Define the question before selecting fields.
2. Exclude email, user ID and client IP when aggregated bands are sufficient.
3. Replace persistent identifiers with scoped pseudonyms.
4. Restrict raw-event access by role and log every export.
5. Set a short retention period for diagnostic data.
6. Keep credentials, cookies, session tokens and payload bodies out of logs.
7. Aggregate results before sharing with proxy vendors or external teams.

An ephemeral identifier may reduce dependence on a persistent account key, but it is not automatically anonymous. Evaluate whether it can still be linked to a person or session in your environment.

Interpreting common patterns

Tunnel or TLS failure with no account-abuse event: investigate gateway reachability, DNS, protocol negotiation and exit health before looking at account policy.

Transport succeeds, authentication fails, and the event shows a method or provider mismatch: verify the documented sign-in flow and client implementation. Changing IPs is unlikely to correct a broken authentication branch.

Only one route changes while account, client and pacing remain fixed: inspect ASN, country, address family and session stability. Repeat with the same route before generalizing.

Risk signals change only after rapid retries: stop the run, review backoff and retry budgets, and allow the application owner to inspect the sequence. Do not attempt to “average out” the signal by adding more exits.

User agent or JA4 changes unexpectedly: check client-library upgrades, proxy tunnel behavior and TLS termination. Do not intentionally spoof fingerprints to evade detection.

Pre-production checklist

• Written authorization covers the accounts, hosts, regions and test window.
• The expected authentication path is documented.
• One correlation key links client, proxy and owner-controlled edge logs.
• Route health and account outcome are stored as separate fields.
• Sensitive identifiers are minimized, pseudonymized and access-controlled.
• Concurrency begins at one with bounded retries and backoff.
• A direct or known-good control exists when permitted.
• Stop conditions cover challenge spikes, lockouts and unexpected data exposure.
• Findings describe evidence and uncertainty rather than assigning blame from one score.

For the transport side of the investigation, pair this model with 98IP's guides to proxy route leak detection, residential proxy session-stickiness testing, and HTTPS proxy TLS troubleshooting.

FAQ

Does a bot score prove a proxy IP is bad?

No. It is a security signal evaluated in a broader context. Measure proxy tunnel success, TLS completion, DNS behavior, latency and session stability independently.

Should we export every new field?

No. Select only the fields needed for the approved diagnostic question. Prefer bands, pseudonyms and short retention over raw identifiers.

Can we change JA4 or user-agent values to make a blocked workflow pass?

Not as an evasion technique. Unexpected fingerprint changes should be diagnosed. Legitimate client changes should follow the application owner's documented compatibility process.

What is the first action after a sudden rejection spike?

Pause automated retries, preserve sanitized correlation evidence and ask the system owner to compare authentication, security and application events. Do not expand account or exit rotation.

Compliance note

Use this workflow only on systems and accounts you own or are explicitly authorized to test. Respect access controls, privacy obligations, identity-provider rules, rate limits and regional restrictions. Proxies must not be used to conceal prohibited access, bypass account protections or evade security decisions. Any exception or allowlist must be approved and implemented by the system owner.

Source note: Cloudflare, “New Logpush datasets and updated fields across multiple Logpush datasets in Cloudflare Logs,” published August 20, 2026. The source URL is retained only in 98IP's internal operations record under the website's zero-external-link policy.