A Indicator of Attack that involves login sessions at impossible times: Close login sessions from drastically different locations.