Impossible Travel Login Detection

What This Means

Detect impossible travel anomalies where a user authenticates from geographically distant locations in an impossibly short timeframe, indicating credential compromise.

Example Log

-- Two logins from physically impossible locations:
Login 1: jsmith@contoso.com from New York, US at 14:00 UTC (IP: 72.21.x.x)
Login 2: jsmith@contoso.com from Moscow, RU at 14:15 UTC (IP: 195.19.x.x)
-- Distance: ~7,500 km in 15 minutes (impossible without teleportation)

Indicators of Suspicious Activity

• Two successful logins from locations hundreds of miles apart within minutes
• Login from a country where the organization has no presence
• Sudden change in login geography after consistent patterns from one location
• Multiple geographic anomalies for the same account in a single day
• Login from a known VPN/proxy service following a legitimate login
• Geographic location inconsistent with the devices timezone setting

How to Investigate

1. Verify with the user whether they are traveling or using a VPN
2. Check the exact IP addresses and determine if either is a VPN/proxy
3. Review the GeoIP data accuracy — some IP geolocation databases have errors
4. Check if the second login used a different authentication method or device
5. Investigate what actions were performed during the suspicious session
6. Determine if any MFA bypass methods were used

Recommended Mitigations

• Implement impossible travel detection in your SIEM or identity provider
• Configure Conditional Access policies that block or require MFA from new countries
• Deploy UEBA (User Entity Behavior Analytics) for geographic anomaly detection
• Set up automated alerts for impossible travel events with P1 severity
• Enable location-based access policies that restrict authentication to known regions
• Require MFA re-verification when geographic anomaly is detected

Related Log Types

Related Attack Patterns

Frequently Asked Questions