Given a table of login attempts, write a SQL query to flag accounts that have attempted to log in from more than three different countries in a 24-hour period.
Return the earliest qualifying 24-hour window for each flagged account. Treat missing countries as unknown and do not count them as distinct countries.
account_id, window_start, window_end, and distinct_country_countaccount_id ascending, then window_start ascending| Column | Type | Description |
|---|---|---|
| attempt_idPK | INT | Unique identifier for the login attempt |
| account_id | INT | Account that initiated the login attempt |
| attempted_at | TIMESTAMPTZ | Timestamp when the login attempt occurred |
| country | VARCHAR(64) | Country associated with the login attempt |