This tells me that you should close it 100% from outside and use VPN. Actually it is closed by the book, every possible measure taken. Cannot be 100% sure off course. This IP is known circulating in honeypots and its in every possible scam database, however this bot specifically works as a winbox s...

My usual routine is to check log files every morning and today I got some intrusion attempts. Winbox is not at the default port and is protected but still.