IP change email to let users know of something suspicious

I want to use a service that is possibly free or may be come up with own simple algorithm to let users know at the time of sign in that a sign in has happened from some unknown location.

We do store all IP addresses when user signs in. How do I compare this and know that a possible fraudulent sign in has happened?

I have seen gmail sending me this kind of email even when I change location from my 1st home to 2nd home (in the same city). On the other end when I reboot my modem and my IP gets changed and I log in from the same location - no email is sent which is correct.

What is the general concept to follow in this case? Any help is appreciated.