Login anomaly detection & suspicious activity alerts

[rohitdash08]

Detect unusual login behavior and alert users.

Acceptance Criteria

• Production ready implementation
• Includes tests
• Documentation updated

[rohitdash08]

/bounty $50

[algora-pbc]

💎 $50 bounty • Rohit Dash

Steps to solve:

1. Start working: Comment /attempt #124 with your implementation plan
2. Submit work: Create a pull request including /claim #124 in the PR body to claim the bounty
3. Receive payment: 100% of the bounty is received 2-5 days post-reward. Make sure you are eligible for payouts

❗ Important guidelines:

• To claim a bounty, you need to provide a short demo video of your changes in your pull request
• If anything is unclear, ask for clarification before starting as this will help avoid potential rework
• Low quality AI PRs will not receive review and will be closed
• Do not ask to be assigned unless you've contributed before

Thank you for contributing to rohitdash08/FinMind!

Attempt	Started (UTC)	Solution	Actions
🟢 @openclawdwang-ship-it	Mar 02, 2026, 04:11:11 AM	WIP
🟢 @maoshuorz	Mar 06, 2026, 11:05:22 AM	#314	Reward
🟢 @Samfresh-ai	Mar 08, 2026, 02:29:16 AM	#328	Reward
🟢 @Pranjal6955	Feb 20, 2026, 05:00:23 PM	#152	Reward
🟢 @PxPerfectMike	Feb 23, 2026, 12:12:37 PM	#171	Reward
🟢 @oskaar23-ops	Feb 24, 2026, 09:52:10 PM	WIP
🟢 @bytebeast40	Feb 26, 2026, 03:34:45 PM	#218	Reward
🟢 @gent33112-wq	Feb 27, 2026, 09:26:54 PM	#254	Reward

[Pranjal6955]

/attempt #124

[PxPerfectMike]

/attempt #124

Implementation Plan

I've implemented a complete login anomaly detection system with the following approach:

Detection Types

1. New IP Detection — Compares login IP against all previously seen IPs for the user
2. New Device Detection — Tracks user agents and flags unrecognized devices
3. Brute Force Detection — Monitors failed login attempts (threshold: 5 failures in 15 min window)
4. Odd Hour Detection — Flags logins during unusual hours (2-5 AM UTC)

Architecture

• Clean service layer separation (services/login_anomaly.py)
• New LoginEvent and LoginAnomaly models with proper DB indexes
• Security API endpoints for history, anomalies, and acknowledgment
• Integrated into existing auth login flow without breaking changes

PR Submitted

#171

10 comprehensive tests all passing. Ready for review!