A security analyst reviews authentication logs and discovers that a user account successfully authenticated from New York at 09:15 AM EST, and the same account authenticated from Tokyo at 09:45 AM EST on the same day. No VPN connections were recorded for this user. What type of indicator of malicious activity has been identified?