NFR: badfrequser attempts from different source IPs
 

Hi
In existing NFR one of the backend of "authentication" package named as "badfrequser" trigger alert when a specific user does more than(>3)continuous bad loging attempts in specified time from a user with "same" source IP using any service like FTP. but it doesnt triggerr alert if a specific user does more than 3 (>3) bad loging attempts from "different" source IPs. i want to add this functionality in "badfreuser backend". how can i do that?
Thanks
Najia