---
title: ToolRouter — Agent Use Case Guide
description: Step-by-step guide for completing a task with a specific AI agent using ToolRouter.
url: https://toolrouter.com/tools/ip-geolocation/use-cases/detect-suspicious-logins/chatgpt
---
# How to Detect Suspicious Logins with ChatGPT

ChatGPT explains suspicious login findings in clear, actionable terms your security team can act on immediately. It provides risk context for each flagged IP, suggests appropriate response actions based on the threat level, and can draft the user notification or escalation message for your incident response workflow.

## Setup

{"mcpServers":{"toolrouter":{"command":"npx","args":["-y","toolrouter-mcp"]}}}

## Steps

1. Configure ToolRouter in ChatGPT
2. Ask: "Look up this IP address and tell me if it looks suspicious for a US-based user"
3. ChatGPT resolves the location and assesses risk
4. Request: "Check these 20 login IPs from the last hour for anomalies"
5. Review the flagged entries

## Example Prompt

```
These are the last 10 login IPs for user account #4521. The user is based in London. Flag any logins from unexpected locations.
```

## Tips

- ChatGPT can assess risk by considering country, ISP type, and distance from baseline
- Ask for a risk score for each login attempt
- Useful for periodic security audits of authentication logs
