Sql Server Brute Force Attack I am running MS Sql Server 2008 on a Windows Server 2008 box. I noticed a slow down and random moments where my Sql instance failed to connect, and looking at the event log showed repeated (1-2 times per second) attempts from an IP address in China to access my "sa" account.

I added the IP address to the block list in my firewall, but the next day the IP address changed and the attack resumed.

Is there any way to automatically add an IP address to my block list if it attempts multiple failed logins? I cannot create a white list, because there are valid connections that come from unknown IPs.
I've never attempted to block traffic at the SQL Server level.  In my experience that is handled via a hardware firewall, Windows Firewall, or both.  I find it interesting that you allow connections to SQL from unknown IP addresses.  I would focus creating a white list of valid, known IP addresses and block everything else as others suggested.

To answer your question:  I did some searching and here is a linked response on writing a SQL query used as a SQL Agent job to block traffic after X number of failed login attempts.  StackOverflow Answer