Django, where to update failed login attempts and why?
Using only the details you list, I would say the Authentication method is more appropriate, if only because it would be very confusing if check_password updates fields on the model. 
Why, though, do you have both an 'Authenticate method in the backed' and a check_password method in the model?
I have a custom user model where I want to track number of failed login attempts and take action based on that. I am wondering what would be a better place to write this logic. 
Following are two options I have in mind for updating *failed_attempts* field in User model:

Autheticate method in the backend.
*check_password* method in the User model. I have overridden this method from AbstractBaseUser model.

And the basic logic(does not cover all cases) is like this:

If authentication fails check the time of previous failed login attempt.
If that was recent, increment failed login count.
If count reaches maximum attempt lock the account for few minutes (or do something else).

My question is what would be a better place for writing this logic and why.