There are many ways to do this.

One way to do it is to write a temporary file in a directory each time a login fails. For example, your directory might look like:

india.pid1
us.pid2
uk.pid3

As you can see you can append the process id to the origins to avoid filename collisions.

Then, in a cron job, you can read the file names and add them up for each origin. Then, read the flat file where the previous values are stored into a array and add the new and old values, and write the new file.

Make sure to clean up the directory of temporary files.

You can also do this without an intermediate temporary file used as an IPC, in a single process, but if you have multiple login failures at one time, you will have have to implement file locking, which might be slower and more complex than a simple IPC like a temporary file.

There are myriad ways to do this. I suggest you use an intermediate approach like I suggested to avoid problems if you get multiple login failures in bursts - having said that, you did not describe the software architecture where the actually login failure flag (detection) occurs.