As mentioned by Aaron, you're login 'say' X would be pointing to a different database rather than NordenWeb, when it throws error with state 38:
You need to check the login for any other mapped databases. To find correct error you need to enable the trace when above error is created:
To dig in deep do nslookup 126.96.36.199 from windows to find the host name, just to verify we are on the correct page:
Now to track the correct database the login is throwing error , start the trace with default template using below 2 category of events:
2.Errors and Warning
a) From the Security Audit category (which is automatically listed in the default trace), keep the "Audit Login Failed" event.
b) From the Errors and Warnings category, only two events were chosen. First, the "ErrorLog" event - this would trap every instance the Error Log is accessed. The second and the most important event was the "User Error Message". This is the event that would capture the error returned to the client
For the columns, only five would be fine: TextData, ApplicationName, NTUserName, LoginName and SPID. Again, you may think the DatabaseID or DatabaseName columns would yield the required information
Finally, choose filter the NTUserName field to determine the account name from the Error Log.
After running trace you will see error message saying:
"Cannot open database requested by the login. The login failed."
From above error message you will get the correct DB name, for which login is throwing error 38.
Try capturing with trace and see if this works!