Possible attack on my SQL server?
If you have a firewall, why is the database server exposed to the internet?


The firewall should block all access to BOTH servers apart from the ports required. Typically this would be 80 (http) and 443 (https) to the web server ONLY.
If (and only if) an external service requires access to the SQL Server, permit access to the specific IP addresses required at the firewall. This should occur via a VPN connection, not openly exposed 1433.
Create a new administrator account and disable the default 'sa'.
Preferably, switch from using "mixed mode" authentication to windows accounts.