A security analyst reviewing the SIEM sees a single user account authenticate successfully from an IP address in Chicago and, eleven minutes later, from an IP address in Warsaw. Which indicator of malicious activity does this BEST describe?