Which file contains information about failed login attempts on a Unix system?

ctmp is not a standard Unix login-tracking file and does not exist in the standard utmp family of files.

wtmp records successful logins, logouts, and system reboots, not failed login attempts.

The /var/log/btmp file (or /var/adm/btmp on some systems) specifically records failed login attempts - so-called bad logins. It is a binary file readable with the 'lastb' command, which parses btmp to display a history of failed authentication events, making it the primary artifact for investigating brute-force or unauthorized login activity.

utmp tracks users who are currently logged in to the system in real time, not a history of failed authentication attempts.