Ask HN: How do you handle suspicious logins?

Have an app w/ a decent number of users (250k). I'm working on some login detection logic using IPs, user agents, etc to determine when a log in maybe be suspicious.

If you've taken on this kind of project, would love to discuss what worked/didn't work. Don't want to reinvent the wheel.

My approach will be to track logins by a combination of user agents, locations and timestamps, and then when a new login comes in, come up with a way to make a login threat level based on what's been seen before.

If it's over a certain value, send off an email to the account owner to notify them.