We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for.
Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175]
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
IPs are unknown, and we would like to know is this a potential security issue or what can cause this.
EDITED
I adjusted Windows Firewall to prevent access to MSSQL outside server IP, but that did not work.
Here is what I did Firewall > Programs and Service > cheched MSSQL Firewall > Edit > Name:MSSQL, PortNumber 1433, TCP, scope: serverIP/255.255.255.255