Detect risk based on ip location from connection logs