It would be nice to have an action in system logging which would allow a script to be run to check the last log entry and allow a script to add the address to the address list as a restricted address and allow us to block.
Someone tryied to establish connection with your routeing by ‘bandwidth-test’ option.
‘tool bandwidth-server set authentication=yes’ forces to use authentication,
moreover you can block unauthorized access for router by adding rules to ‘chain=input’, if you want to avoid the following issue.