Detects impossible-travel style sign-ins for Anthropic accounts by correlating two successful magic-link or SSO authentications for the same user.email within a 24-hour window. The rule leverages IP_LOCATION to geolocate source IPs and computes the geospatial distance between the first and last sign-in events for each user.email, deriving the travel speed. If the distance is at least 1,000 km and the inferred travel speed is at least 800 km/h, the event pair is flagged as suspicious. This pattern suggests account sharing, VPN/proxy egress inconsistencies, or an adversary authenticating from a distant geographic location relative to the user’s baseline. The detection operates on Anthropic audit logs (from logs-anthropic.audit-*) with authentication events, requiring at least two sign-ins for a user. The rule computes and exposes fields such as first/last geo coordinates, distance_km, travel_kmh, and the timestamp window for investigation. It is categorized under Initial Access with MITRE ATT&CK technique T1078 (Cloud Accounts). A note emphasizes that A-B-A travel patterns may not always trigger alerts if coordinates are similar, so timeline ordering of raw authentication events is recommended during triage. Recommended triage includes comparing event timestamps, source IPs, user agents, and pairing with related failures or MFA changes. If the sign-ins appear unauthorized, actions include revoking sessions, resetting credentials/MFA, and reviewing admin or data-access activity after the distant sign-in. The rule provides structured investigation fields to ease analyst review and supports suppression by user.email within a 24-hour window to reduce noise for repeated legitimate travel.