Hacker News Reader

maybe to detect that the valid credentials are leaked / used in the wilds?

Exactly; a valid login attempt from abroad should trigger an immediate account lock and credentials reset for sensitive systems like this.