---
title: ToolRouter — Agent Use Case Guide
description: Step-by-step guide for completing a task with a specific AI agent using ToolRouter.
url: https://toolrouter.com/tools/ip-geolocation/use-cases/detect-suspicious-logins/claude
---
# How to Detect Suspicious Logins with Claude

Claude brings analytical rigor to login anomaly detection by calculating geographic distance, assessing travel feasibility, and evaluating ISP fingerprints against user baselines. It asks clarifying questions about your security thresholds to refine the risk assessment for each flagged login attempt.

## Setup

claude mcp add toolrouter -- npx -y toolrouter-mcp

## Steps

1. Connect ToolRouter: claude mcp add toolrouter -- npx -y toolrouter-mcp
2. Ask Claude: "Look up the location of this login IP using ip-geolocation" and provide the IP
3. Claude returns the geographic details
4. Ask: "Compare this location against the user's previous logins from New York"
5. Claude flags whether the location is suspicious based on distance and timing

## Example Prompt

```
Look up the location of 185.220.101.34. A user who normally logs in from San Francisco just authenticated from this IP. Is this suspicious?
```

## Tips

- Check for VPN and proxy indicators in the ISP data
- Compare timestamps between logins to detect impossible travel
- Build a baseline of normal login locations for each user
