Thanks for your response.

The default database is "master". So, I don't think there's any changes on the database.

Would it be possible for us to track which databases the login try to connect?