Hi Forum members,
I went through all messages regarding this topic and tried to remove all possible causes of the issue.
Basically, i'm getting entries in the logs each 30sec :
"login failure for user admin from MIKROTIK_IP_ROUTER_ADDRESS via winbox"
"login failure for user admin from ONE_LAYER_ABOVE_MIKROTIK_IP_ROUTER_ADDRESS via winbox". The router trying to connect is my local ISP router triple play router and there is no 8291 port redirection on it.

The Dude is not activated, I have removed ssh from the list of services and admin account is disabled.

I'm truly stuck...

Thanks for any help or advice.

Laurent

Check your firewall rules.
You may also want to check devices on your LAN, some virus scanners are known to cause this behavior.
Clearly something/someone is trying to get in.

But a VERY good thing you disabled admin account !! (first thing I do on a new device as well)

topic can be closed... The Dude still running on the router. Managed to disable it and messages disappeared...

See ? Something was trying to get in

yes !!!