How to write a script to detect anomalous login locations

Question

I am trying to improve security monitoring by detecting logins from unusual locations. My questions are:

• How can I extract IP addresses from authentication logs (/var/log/auth.log, /var/log/secure)?
• How can I use geolocation APIs (like ipinfo.io, MaxMind) to map IPs to locations?
• How to define an "anomalous" login (e.g., new country, unusual time, failed attempts)?

A Python or Bash script that automates this detection and sends alerts would be useful.