Please add an option to escalate logins from datacenter IPs "even when there's no other indicator".

This will help detect proxying and MITM attacks, since datacenter IPs are used for attacks as frequently as VPNs are, as per my experience.

It should have configurable rules similar to existing VPN alerts.