Atypical travel Sign in from an atypical location based on the user's recent sign-ins. Anonymous IP address Sign in from an anonymous IP address (for example: Tor browser, anonymizer VPNs). Unfamiliar sign-in properties Sign in with properties we've not seen recently for the given user. Malware linked IP address Sign in from a malware linked IP address Leaked Credentials This risk detection indicates that the user's valid credentials have been leaked Azure AD threat intelligence Microsoft's internal and external threat intelligence sources have identified a known attack pattern