14,501 questions
They stopped when I turned off the incoming rule that allowed port 1433.
Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: XXX.XXX.XXX.XXX]
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 66%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVV%3C/text%3E%3C/svg%3E)
Volk Volk
551
Reputation points
HI!
Every minute I receive such messages (5-50 messages) on my server Win 2022 (in Event Viewer-->Application):
Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: XXX.XXX.XXX.XXX]
Login failed for user 'brett'. Reason: Password did not match that for the login provided. [CLIENT: XXX.XXX.XXX.XXX]
Login failed for user 'qingshu'. Reason: Password did not match that for the login provided. [CLIENT: XXX.XXX.XXX.XXX]
Login failed for user 'dayane'. Reason: Password did not match that for the login provided. [CLIENT: XXX.XXX.XXX.XXX]
....
....
....
How do I stop this? I read on some forums that these are attempts to hack MSSQL from the outside. Is it true? Why is this happening? And what should I do in this case?
Thanks!
SQL Server | Other
1 answer
Sort by: Most helpful
-
Volk Volk 551 Reputation points
2024-07-13T15:10:58.3933333+00:00 -
Erland Sommarskog 121.9K Reputation points MVP Volunteer Moderator2024-07-13T15:32:06.3366667+00:00 Good call. :--) Never expose SQL Server directly on the internet. If you do, you will have these people knocking on the door trying to get in with a brute-force attack.
Sign in to comment -