Distance

GeoFraud Detection

Measures how far apart two consecutive events are geographically — calculated from the IP-based location attached to each event. A user in New York then Tokyo 5 minutes later? Impossible travel.

Returns{ distance, latitude, longitude }

When to Use

• Impossible travel detection: a user can't be in two countries within minutes unless using a VPN or sharing credentials
• Account takeover detection: a sudden login from a geographically distant location
• Identifying account sharing across regions

Configuration

{
  "name": "distance_between_phone_login_10m",
  "operation": "distance",
  "group_by": "event_properties.phone",
  "window_duration_seconds": 600,
  "filters": { "field": "event_name", "operator": "equals", "value": "Login" }
}

Note: If fields are not specified, uses latitude and longitude from event data.

Example Event Sequence

// user logs in from (34.0522, -118.2437)
honeypot.track('Login', { phone: '123-456-7890' });

// sometime later...

// user logs in from (40.7128, -74.006)
honeypot.track('Login', { phone: '123-456-7890' });

Response

{
  "behaviors": {
    "distance_between_login_10m": {
      "distance": 0,
      "latitude": 34.0515,
      "longitude": -84.0713,
      "timestamp": "2025-06-12T20:55:57.783Z",
      "remaining_window_seconds": 600
    }
  }
}