New ask Hacker News story: Ask HN: How do you handle suspicious logins?

Ask HN: How do you handle suspicious logins?
4 by onassar | 4 comments on Hacker News.
Have an app w/ a decent number of users (250k). I'm working on some login detection logic using IPs, user agents, etc to determine when a log in maybe be suspicious. If you've taken on this kind of project, would love to discuss what worked/didn't work. Don't want to reinvent the wheel. My approach will be to track logins by a combination of user agents, locations and timestamps, and then when a new login comes in, come up with a way to make a login threat level based on what's been seen before. If it's over a certain value, send off an email to the account owner to notify them.