1. A computer implemented method comprising: receiving, by an online system, a list of known compromised login credentials for a plurality of users; receiving, at a first time point, a first login attempt to login to the online system using a first set of login credentials; determining that the first set of login credentials matches a first set of compromised login credentials on the list of known compromised login credentials; identifying a source associated with the first login attempt; identifying the source as a potentially suspicious source; receiving, at a second time point, a second login attempt to login to the online system using a second set of login credentials; determining that the second set of login credentials matches a second set of compromised login credentials on the list of known compromised login credentials; determining timing characteristics from the first time point of the first login attempt and the second time point of the second login attempt; determining that the source associated with the first login attempt is also the source associated with the second login attempt; generating a suspiciousness index for the second login attempt based on the determined timing characteristics and the determination that the source is also associated with the second login attempt; and based on the generated suspiciousness index, providing a security challenge to a client device associated with the second login attempt before providing the client device with access to the online system.