php - What's are some reliable ways to identify suspicious logins? -

php - What's are some reliable ways to identify suspicious logins? -

i'm interested in implementing feature on web application warns users when suspicious log in has occurred since lastly visit.

my kneejerk reaction utilize client's ip address, after doing research seems terrible idea. dynamic allocation , nat suggest not reliable.

my sec thought utilize geolocation service. ones find either ip-based or outside of price-range.

my 3rd thought implement facebook's "register device" prompt, i'm unsure how works in reliable way.

does have ideas on how identify device or location reasonable level of confidence?

it depends on business rules. score based on several factors.

not same ip: +5 not same subnet: +10 not same country: +100 3 or more attempts before success: +50 2 or more logins @ same time: +50 different browser lastly time: +5

etc.

then setup rules say:

0-20: tell user on next successful login. 21-50: start making them wait 5 minutes between logins. 51-100: lock business relationship , forcefulness them unlock via email confirmation.

i show them lastly date , ip of login gmail does. gmail has login history can view.

php javascript web-applications ip