ML Based User Login Anomaly Detection System

I'm looking for a Machine Learning (Anomaly Detection) expert to develop an application capable of identifying potential threats from user access logs on my website.

My website logs of all logins attempt (successful / failed) into a database which will be used as a training base for ML.

Once a user tries to log-in, my website will make an API request to this application passing the login information (Username / IP address) which should analyse it and return if the login is OK not suspicious based on anomaly detection

For example: A user called Bob always logs into my website from an IP which is based in the USA. For the first time Bob is trying to access the website from an IP in China. That should be flagged as suspicious.

Example of the log:

bob.jones_at_domain123.com Logon Failed IP: 111.71.154.81
matt.smith_at_domain123.com Logon Failed IP: 85.14.108.154
bob.jones_at_domain123.com Logon Failed IP: 110.76.3.158
bob.jones_at_domain123.com Logon Failed IP: 36.133.146.176
matt.smith_at_domain123.com Logon Failed IP: 59.49.141.141
bob.jones_at_domain123.com Logon Failed IP: 113.107.10.6
kgaulteau_at_domain123.com Logon Pass IP: 101.138.116.93
bob.jones_at_domain123.com Logon Failed IP: 139.113.140.6
bob.jones_at_domain123.com Logon Failed IP: 183.105.138.168
matt.smith_at_domain123.com Logon Pass IP: 190.113.17.130
matt.smith_at_domain123.com Logon Failed IP: 111.113.116.111
bob.jones_at_domain123.com Logon Failed IP: 118.181.31.16
bob.jones_at_domain123.com Logon Failed IP: 183.181.107.106
bob.jones_at_domain123.com Logon Failed IP: 116.86.168.10
bob.jones_at_domain123.com Logon Failed IP: 107.119.111.44
matt.smith_at_domain123.com Logon Pass IP: 190.58.168.141
bob.jones_at_domain123.com Logon Failed IP: 94.61.7.100
bob.jones_at_domain123.com Logon Failed IP: 111.130.87.115
bob.jones_at_domain123.com Logon Failed IP: 161.0.156.140