1. A computer implemented method comprising: receiving a list of known compromised login attempts, each compromised login attempt of the list comprising at least a user account identifier and a password; receiving a first set of login information submitted from a client device in connection with a first attempt to login to an online system, the first set of login information including a submitted user account identifier and a submitted password; determining whether the first set of login information matches a compromised login attempt from the list of compromised login attempts; if the first set of login information matches a compromised login attempt, identifying a source location associated with the first attempt to login to the online system; and determining a suspiciousness index of the source location associated with the first attempt to login to the online system that includes whether the first set of login information matches a compromised login attempt.