Detects successful Anthropic audit activity for the same user email where source IPs resolve to multiple geographic locations across at least two countries, separated by 500+ km, and with an inferred travel speed above 800 km/h within a short window (~15 minutes). Implemented on Anthropic audit logs (anthropic.audit dataset) via ES|QL, it uses IP_LOCATION to obtain country, city, and coordinates, then computes distance and travel speed between the first and last observed geo positions for a given user.email. If there are two or more events, at least two distinct countries, distance >= 500 km, and travel speed >= 800 km/h, an alert is produced. Unlike login-only impossible travel, this rule flags any successful user_actor actions (e.g., exports, admin actions) that could indicate session cookie replay or concurrent session reuse in the absence of new authentications. It maps to MITRE techniques T1539 (Steal Web Session Cookie) under Credential Access and T1078 (Valid Accounts) with a cloud accounts subtechnique, highlighting potential takeover risk when distant actions occur without new logins. It includes alert suppression by user.email for a 15-minute window and specifies investigation fields to compare IPs, geo data, user agents, and actions across events. False positives arise from VPN/proxy geolocation noise, dual-homed or split-tunnel clients, and cloud egress where distinct IPs belong to the same legitimate session; additional ASN/UA correlation is recommended. Recommended triage steps include validating distance/speed calculations, sorting timelines by IP, country, UA, and action, checking for nearby logins, and pairing with Anthropic Impossible Travel Login rules when takeover is suspected. Remediation upon suspicion of replay or compromise includes revoking sessions, resetting credentials/MFA, reviewing exports/role changes for the user, and ensuring governance around cross-border sessions. The rule emphasizes proactive incident response and correlation with credential-access and initial-access workflows. References to related documentation are included in the rule.