Your files stay on your device

# Sign-In anomaly analyzer

Scan pasted sign-in logs for password spraying, brute force and travel anomalies, with adjustable thresholds.

Add a sign-in log and the rules run right away. The sample log shows a password spray with fake addresses.

Treat every finding as a lead, not a verdict. VPN exits, shared office NAT, and mobile carrier gateways all make one address look like many users or one user look like many countries, and a cloud mail client can fail sign-ins for boring reasons. Logs that carry only a country get the weaker fast country change signal, never computed travel, because travel math needs coordinates the log does not have. Rows with no readable outcome are counted and left out of every rule rather than guessed, and users under the baseline are skipped instead of flagged. A clean result only covers the rows you pasted here.
OptionsAnalyze

## More network tools

- [CloudTrail analyzer](/network/aws-cloudtrail-log-analyzer)
[All network tools](/network)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/authentication-anomaly-analyzer
Markdown version: https://nutter.tools/network/authentication-anomaly-analyzer.md
Plain-text version: https://nutter.tools/network/authentication-anomaly-analyzer.txt
Agent index: https://nutter.tools/llms.txt