Detect Multi-IP Transaction Bursts | Dataford Interview Questions

Write a SQL query to identify users who have initiated transactions from multiple distinct IP addresses within a five-minute window.

Use the transactions table. A qualifying window begins at a transaction timestamp and includes transactions through five minutes afterward. Ignore transactions with a NULL IP address. Return each user only once, using their earliest qualifying window.

Output

One row per qualifying user with user_id, window_start, window_end, distinct_ip_count, and ip_addresses
Sort by user_id ascending; break ties by window_start ascending

Schema

transactions

Column	Type	Description
transaction_idPK	INT	Unique transaction identifier
user_id	INT	Identifier of the user who initiated the transaction
initiated_at	TIMESTAMP	Timestamp when the transaction was initiated
ip_address	VARCHAR(45)	Source IPv4 or IPv6 address

Your question is Detect Multi-IP Transaction Bursts. Start with the requirements and the one table in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Write a SQL query to identify users who have initiated transactions from multiple distinct IP addresses within a five-minute window.

Output

One row per qualifying user with user_id, window_start, window_end, distinct_ip_count, and ip_addresses
Sort by user_id ascending; break ties by window_start ascending

Schema

transactions

Column	Type	Description
transaction_idPK	INT	Unique transaction identifier
user_id	INT	Identifier of the user who initiated the transaction
initiated_at	TIMESTAMP	Timestamp when the transaction was initiated
ip_address	VARCHAR(45)	Source IPv4 or IPv6 address

Your question is Detect Multi-IP Transaction Bursts. Start with the requirements and the one table in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.