In addition to the advice given, I might go so far as to declare an emergency "hotfix" during the middle of the day for an hour or two.

Block traffic to the SQL box via the firewall and monitor to see if the failed login continues to happen.

I am betting the failed attempt is coming from internal.

When coming from external, the failures will typically be far more frequent.