Long Weekend

You are a tier-one analyst. Korgan Insurance JSC is an insurance company. In the morning an alert arrives: the server KOR-SRV-CRM recorded an unusual number of failed logons during the night.

People mistype passwords every day and most such spikes are not incidents. Your job is to decide whether this one is, and if so to reconstruct the sequence: where the attempts came from, when they stopped and what happened next.

You have the security log for the day. Timestamps are UTC; the office runs on Astana time (UTC+5).