Write a query that detects repeated authentication failures from the same IP within a 10-minute window. Then explain how you would determine whether the pattern indicates malicious activity or simple user error.