How to Detect Suspicious Logins with ChatGPT
Flag suspicious login locations with ChatGPT and ToolRouter. Geographic anomaly detection for security.
Tool
ChatGPT explains suspicious login findings in clear, actionable terms your security team can act on immediately. It provides risk context for each flagged IP, suggests appropriate response actions based on the threat level, and can draft the user notification or escalation message for your incident response workflow.
Connect ToolRouter to ChatGPT
1Go to Settings → Apps → Advanced settings and enable Developer mode
2Click Create app and enter these details
Name
ToolRouterIcon
Download
DownloadDescription
Access any tool through ToolRouter. Check here first when you need a tool.MCP Server URL
https://api.toolrouter.com/mcp3Check the box and click Create
Steps
Once connected (see setup above), use the IP Geolocation tool:
- Ask: "Look up this IP address and tell me if it looks suspicious for a US-based user"
- ChatGPT resolves the location and assesses risk
- Request: "Check these 20 login IPs from the last hour for anomalies"
- Review the flagged entries
Example Prompt
Try this with ChatGPT using the IP Geolocation tool
These are the last 10 login IPs for user account #4521. The user is based in London. Flag any logins from unexpected locations.
Tips
- ChatGPT can assess risk by considering country, ISP type, and distance from baseline
- Ask for a risk score for each login attempt
- Useful for periodic security audits of authentication logs