diff --git a/app/models/report.rb b/app/models/report.rb
index f7540b71eba..5d1d1a22d4a 100644
--- a/app/models/report.rb
+++ b/app/models/report.rb
@@ -1441,6 +1441,7 @@ class Report
       WHERE t.action = 'suspicious'
         AND t.created_at >= :start_date
         AND t.created_at <= :end_date
+      ORDER BY t.created_at DESC
     SQL
 
     DB.query(sql, start_date: report.start_date, end_date: report.end_date).each do |row|
diff --git a/spec/models/report_spec.rb b/spec/models/report_spec.rb
index 76896b4919f..11437020243 100644
--- a/spec/models/report_spec.rb
+++ b/spec/models/report_spec.rb
@@ -1006,11 +1006,10 @@ describe Report do
     context "with data" do
       it "works" do
         SiteSetting.verbose_auth_token_logging = true
-        freeze_time DateTime.parse('2017-03-01 12:00')
 
-        UserAuthToken.log(action: "suspicious", user_id: robin.id)
-        UserAuthToken.log(action: "suspicious", user_id: joffrey.id)
-        UserAuthToken.log(action: "suspicious", user_id: joffrey.id)
+        UserAuthToken.log(action: "suspicious", user_id: joffrey.id, created_at: 2.hours.ago)
+        UserAuthToken.log(action: "suspicious", user_id: joffrey.id, created_at: 3.hours.ago)
+        UserAuthToken.log(action: "suspicious", user_id: robin.id, created_at: 1.hour.ago)
 
         report = Report.find("suspicious_logins")