Identity attacks don't just come from suspicious geographic locations or VPNs — there's a third dimension: datacenter infrastructure. Huntress ITDR researcher Matt Kiely describes how he discovered a critical detection gap: attackers were gaining initial access via datacenter IPs with no VPN/proxy tags, leaving no initial access alert despite post-exploitation activity being caught. The solution was to classify logins by Autonomous System (AS) organization rather than geography, establishing a baseline of normal datacenter activity per identity and flagging logins from high-abuse-potential AS providers (e.g., those accepting anonymous crypto). After launching in August 2025, the system reduced 10M+ datacenter auth events to a few hundred daily investigations, with a 3.2% false positive rate — better than the 4-5% baseline. The key insight: 'location' in identity security must account for geography, technology fingerprint (VPN/proxy), and underlying infrastructure (datacenter/AS).
