User Login From Multiple Countries

nomit vyas@xoxo

•updated Feb 8, 2026•1•0•43

Detects a user successfully logging in from multiple different countries within a short time frame (4 hours). This is a strong indicator of account takeover (T1078).