I was asked by a friend, who isn't technical at all, to help her with her application.
I thought I would just being doing a little C# development and some SQL queries. Turns out it has been a lot more than that. Needless to say I've learned a lot.
I've stumbled upon the Server Logs in SSMS. To my surprise there are TONS of failed login attempts. The login attempts are primarily using the username 'sa' but there are others, for example: 'KHB', 'wwo' 'IIS' 'hpv7' 'N200user' 'kisadmin'. These usernames make no sense. I am the only one who should be logging into this database. The error is either.
Error: 18456, Severity:14, State: 8 or Error: 18456, Severity:14, State: 5
State 8 only happens when the login attempt is for the username 'sa'.
The majority of these attempts are happening between 1am-4am.
This seems real fishy.
Any suggestions on what I should do?