About this video
Impossible travel is an indicator of compromise that security teams monitor to identify potentially hijacked accounts. It is triggered when authentication logs show a user logging in from one geographic region and then, within an unrealistically short time frame, logging in again from a location that could not have been reached through any means of travel. The physical impossibility of covering that distance in that window of time is what gives the indicator its name.
This pattern is a strong signal of unauthorized account access, suggesting that credentials have been stolen and are being used by a threat actor operating from a different location than the legitimate account owner. Security monitoring systems and SIEM platforms commonly apply geolocation and velocity checks against login events to detect this behavior automatically, generating alerts that analysts can investigate for potential account takeover or credential compromise.
What you'll learn
- Explain how impossible travel serves as an indicator of compromise in identifying unauthorized account access
What's covered
Impossible Travel
- Definition
- Login from distant locations
- Timeframe is impossible
- Example Scenario
- Login in Pacific Northwest
- Login in South Africa
- 10 minutes apart
- Security Implication
- Indicator of compromise
- Account likely hacked
- Unauthorized account use
Key terms
- Indicators of Compromise
IoC
- Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
- Impossible Travel
- A security alert triggered when account logins occur from geographically distant locations within a timeframe that makes physical travel impossible, indicating potential unauthorized access.
- Authentication
- The process of verifying the identity of a user, device, or system.
Topics
Impossible Travel
Indicator Of Compromise
Identity And Access Management
Threat Detection
Account Compromise
Cybersecurity Analytics
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →