# How do I detect a VPN account used from two countries at the same time?

With your VPN gateway's or identity provider's sign-in logs, because only they know which account each session belongs to. Look for the same user signing in from two places too far apart for the time between them, a session from a country where you have no staff, or a sign-in from an address that belongs to a hosting provider or an anonymising service. Many identity providers and VPN gateways can raise this automatically, often as impossible-travel or risky sign-in detection; switch it on, and require multi-factor authentication so that a stolen password alone is not enough. The network gives the second half of the picture. The NetSenX VPN view lists the tunnels and gateway sessions it sees on monitored segments, with the country the remote address is registered in, and flags addresses on lists of commercial VPN services and Tor exits. It does not link sessions to accounts, so the identity logs remain the place where this alert belongs.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/how-to-detect-a-vpn-account-used-from-two-countries

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [What is impossible travel, and which tool detects it?](https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it)
- [Can network monitoring see where our VPN users connect from?](https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from)
- [Can NetSenX monitor a laptop that is outside the office?](https://netsenx.com/en/faq/can-netsenx-monitor-a-laptop-outside-the-office)
- [Do home-office laptops need the NetSenX agent installed?](https://netsenx.com/en/faq/do-home-office-laptops-need-the-netsenx-agent)
- [Should executive laptops get extra monitoring?](https://netsenx.com/en/faq/should-executive-laptops-get-extra-monitoring)