Impossible Travel Login Detection

nomit vyas@xoxo

•updated Apr 30, 2026•4•0•228

This rule identifies "impossible travel" scenarios where a user logs in from two geographically distant locations within a short period (less than 2 hours). This can indicate a compromised account being used by an attacker, potentially leveraging VPNs or other proxy services to obscure their true location.