관리하고 있는 계정 중 고객의 요청에 의해 ftp 정보를 알려드린 계정이 있습니다.
약 3일 전 부터 홈페이지가 조금 씩 오작동을 하다가 어제부터 index 페이지에 에러가 발생하는 등의 문제가 있어 어제서야 알려오셨습니다.
확인 해 본 결과 계정 내의 모든 파일 중 index, default, home 이라는 단어가 들어간 파일들이 변조 되어 있었습니다.
1. 우선 ftp 접속을 차단하고
2. 현재상태 백업 후
3. 변조된 파일을 복구 하였습니다.
서버의 각종 접속 로그를 확인 해 본 결과 해외의 다양한 ip 들이 ftp 접속을 하고 있었고
고객PC의 바이러스 검사를 해 본 결과 V.BKD.Rustock.E 라는 스팸발송용/백도어 가 설치되어 있었습니다.
바이러스 검사 프로그램 으로 업데이트 된 알약을 사용 하였습니다.
웹 어플리케이션 보안 강화에 민감한 회사로서 진땀 뺀 하루였습니다.
이제 클라이언트 PC 보안까지 생각 해야할 정도로 깊숙히 침투한 바이러스/백도어 프로그램들..
어찌 해야 할까요..
1. 우선 내부 작업용 PC 의 보안상태를 주기적으로 점검 하고
2. 클라이언트 PC 의 보안도 챙길 수 있도록 홈페이지에 안내 해드려야 겠습니다.
3. ftp 정보는 꼭 필요할 경우만 알려드리고, 각종 관리 문제 뿐 아니라 보안 문제에 대해서도 주지 시켜 드려야 겠습니다.
<< 해당 백도어 프로그램에 대한 분석자료 링크 >>
<< ftp 접속 로그 참고 / 일부 단어는 xxx 로 대체 하였음 >>
Jun 8 05:11:51 xxx64-017 proftpd[14501]: xxx64-017.xxxxx.com (76.107.210.144[76.107.210.144]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:00 xxx64-017 proftpd[14559]: xxx64-017.xxxxx.com (89.243.145.213[89.243.145.213]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:10 xxx64-017 proftpd[14663]: xxx64-017.xxxxx.com (86.24.215.183[86.24.215.183]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:21 xxx64-017 proftpd[14712]: xxx64-017.xxxxx.com (69.1.54.242[69.1.54.242]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:40 xxx64-017 proftpd[14774]: xxx64-017.xxxxx.com (71.80.107.161[71.80.107.161]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:49 xxx64-017 proftpd[14820]: xxx64-017.xxxxx.com (173.26.74.236[173.26.74.236]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:57 xxx64-017 proftpd[14856]: xxx64-017.xxxxx.com (68.46.37.54[68.46.37.54]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:05 xxx64-017 proftpd[14906]: xxx64-017.xxxxx.com (69.76.90.157[69.76.90.157]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:14 xxx64-017 proftpd[14956]: xxx64-017.xxxxx.com (70.161.13.56[70.161.13.56]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:24 xxx64-017 proftpd[15000]: xxx64-017.xxxxx.com (71.74.126.136[71.74.126.136]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:35 xxx64-017 proftpd[15056]: xxx64-017.xxxxx.com (67.38.0.218[67.38.0.218]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:47 xxx64-017 proftpd[15104]: xxx64-017.xxxxx.com (216.215.128.96[216.215.128.96]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:58 xxx64-017 proftpd[15150]: xxx64-017.xxxxx.com (64.231.21.139[64.231.21.139]) - USER semxxxxxxx: Login successful.
Jun 8 05:14:10 xxx64-017 proftpd[15259]: xxx64-017.xxxxx.com (82.2.142.36[82.2.142.36]) - USER semxxxxxxx: Login successful.
Jun 8 15:53:06 xxx64-017 proftpd[23848]: xxx64-017.xxxxx.com (75.208.83.242[75.208.83.242]) - USER semxxxxxxx (Login failed): Incorrect password.
Jun 8 17:54:55 xxx64-017 proftpd[25863]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:55:24 xxx64-017 proftpd[26233]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:56:44 xxx64-017 proftpd[26839]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:56:47 xxx64-017 proftpd[26879]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:57:13 xxx64-017 proftpd[27111]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:57:35 xxx64-017 proftpd[27276]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:57:38 xxx64-017 proftpd[27320]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:18 xxx64-017 proftpd[27612]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:21 xxx64-017 proftpd[27650]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:32 xxx64-017 proftpd[27715]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:36 xxx64-017 proftpd[27754]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:59:03 xxx64-017 proftpd[27948]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:59:05 xxx64-017 proftpd[27991]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:59:08 xxx64-017 proftpd[28029]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:00 xxx64-017 proftpd[28430]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:04 xxx64-017 proftpd[30582]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:08 xxx64-017 proftpd[30754]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:13 xxx64-017 proftpd[30805]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:28 xxx64-017 proftpd[30911]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:34 xxx64-017 proftpd[30962]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:37 xxx64-017 proftpd[31001]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:39 xxx64-017 proftpd[31034]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:51 xxx64-017 proftpd[31124]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:59 xxx64-017 proftpd[31187]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:15 xxx64-017 proftpd[31297]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:18 xxx64-017 proftpd[31340]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:44 xxx64-017 proftpd[31534]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:47 xxx64-017 proftpd[31588]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:02:52 xxx64-017 proftpd[32122]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:02:54 xxx64-017 proftpd[32166]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:02 xxx64-017 proftpd[32245]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:05 xxx64-017 proftpd[32285]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:17 xxx64-017 proftpd[32376]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:20 xxx64-017 proftpd[32420]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:25 xxx64-017 proftpd[32472]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:06 xxx64-017 proftpd[318]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:09 xxx64-017 proftpd[405]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:11 xxx64-017 proftpd[471]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:16 xxx64-017 proftpd[525]: xxx64-017.xxxxx.com (24.185.138.61[24.185.138.61]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:22 xxx64-017 proftpd[583]: xxx64-017.xxxxx.com (24.184.197.118[24.184.197.118]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:29 xxx64-017 proftpd[659]: xxx64-017.xxxxx.com (68.32.38.86[68.32.38.86]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:39 xxx64-017 proftpd[748]: xxx64-017.xxxxx.com (174.144.169.185[174.144.169.185]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:49 xxx64-017 proftpd[906]: xxx64-017.xxxxx.com (24.62.246.22[24.62.246.22]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:59 xxx64-017 proftpd[977]: xxx64-017.xxxxx.com (68.76.103.151[68.76.103.151]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:06 xxx64-017 proftpd[1224]: xxx64-017.xxxxx.com (66.233.187.1[66.233.187.1]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:15 xxx64-017 proftpd[1325]: xxx64-017.xxxxx.com (88.174.41.21[88.174.41.21]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:25 xxx64-017 proftpd[1398]: xxx64-017.xxxxx.com (68.230.162.230[68.230.162.230]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:33 xxx64-017 proftpd[1480]: xxx64-017.xxxxx.com (68.230.162.230[68.230.162.230]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:40 xxx64-017 proftpd[1544]: xxx64-017.xxxxx.com (68.46.37.54[68.46.37.54]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:47 xxx64-017 proftpd[1618]: xxx64-017.xxxxx.com (76.198.235.246[76.198.235.246]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:53 xxx64-017 proftpd[1736]: xxx64-017.xxxxx.com (67.8.85.126[67.8.85.126]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:05 xxx64-017 proftpd[1963]: xxx64-017.xxxxx.com (76.84.66.25[76.84.66.25]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:25 xxx64-017 proftpd[2158]: xxx64-017.xxxxx.com (99.234.221.235[99.234.221.235]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:41 xxx64-017 proftpd[2275]: xxx64-017.xxxxx.com (68.53.0.30[68.53.0.30]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:52 xxx64-017 proftpd[2389]: xxx64-017.xxxxx.com (173.2.38.29[173.2.38.29]) - USER semxxxxxxx: Login successful.
Jun 8 18:07:04 xxx64-017 proftpd[2454]: xxx64-017.xxxxx.com (76.31.144.86[76.31.144.86]) - USER semxxxxxxx: Login successful.
Jun 9 13:39:51 xxx64-017 proftpd[16947]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 13:45:46 xxx64-017 proftpd[19825]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 13:45:56 xxx64-017 proftpd[19970]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:08:06 xxx64-017 proftpd[32404]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:08:55 xxx64-017 proftpd[32653]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:12:48 xxx64-017 proftpd[2074]: xxx64-017.xxxxx.com (121.141.142.63[121.141.142.63]) - USER semxxxxxxx (Login failed): Incorrect password.
Jun 9 14:12:53 xxx64-017 proftpd[2103]: xxx64-017.xxxxx.com (121.141.142.63[121.141.142.63]) - USER semxxxxxxx: Login successful.
Jun 9 14:17:35 xxx64-017 proftpd[4381]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:18:07 xxx64-017 proftpd[4677]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:28:16 xxx64-017 proftpd[9268]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:30:03 xxx64-017 sshd[9877]: Accepted password for semxxxxxxx from ::ffff:121.141.139.23 port 58647 ssh2
Jun 9 14:34:42 xxx64-017 proftpd[12475]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:34:42 xxx64-017 proftpd[12476]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:34:42 xxx64-017 proftpd[12477]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 15:44:57 xxx64-017 proftpd[18354]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:20 xxx64-017 proftpd[31249]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:24 xxx64-017 proftpd[31292]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:28 xxx64-017 proftpd[31335]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:37 xxx64-017 proftpd[31417]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:46 xxx64-017 proftpd[31494]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:48 xxx64-017 proftpd[31545]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:59 xxx64-017 proftpd[31644]: xxx64-017.xxxxx.com (72.235.99.253[72.235.99.253]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:09 xxx64-017 proftpd[31862]: xxx64-017.xxxxx.com (142.169.117.13[142.169.117.13]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:19 xxx64-017 proftpd[31960]: xxx64-017.xxxxx.com (87.192.227.111[87.192.227.111]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:27 xxx64-017 proftpd[32035]: xxx64-017.xxxxx.com (174.48.228.61[174.48.228.61]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:53 xxx64-017 proftpd[32279]: xxx64-017.xxxxx.com (75.251.42.6[75.251.42.6]) - USER semxxxxxxx: Login successful.
Jun 9 16:05:26 xxx64-017 proftpd[351]: xxx64-017.xxxxx.com (75.45.83.141[75.45.83.141]) - USER semxxxxxxx: Login successful.
Jun 9 16:05:37 xxx64-017 proftpd[467]: xxx64-017.xxxxx.com (85.87.76.153[85.87.76.153]) - USER semxxxxxxx: Login successful.
Jun 9 16:05:53 xxx64-017 proftpd[602]: xxx64-017.xxxxx.com (203.221.31.44[203.221.31.44]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:01 xxx64-017 proftpd[800]: xxx64-017.xxxxx.com (68.53.175.252[68.53.175.252]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:11 xxx64-017 proftpd[892]: xxx64-017.xxxxx.com (66.41.176.62[66.41.176.62]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:19 xxx64-017 proftpd[969]: xxx64-017.xxxxx.com (173.33.3.65[173.33.3.65]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:29 xxx64-017 proftpd[1060]: xxx64-017.xxxxx.com (65.188.169.154[65.188.169.154]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:38 xxx64-017 proftpd[1127]: xxx64-017.xxxxx.com (173.81.194.69[173.81.194.69]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:48 xxx64-017 proftpd[1215]: xxx64-017.xxxxx.com (24.99.136.140[24.99.136.140]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:05 xxx64-017 proftpd[1443]: xxx64-017.xxxxx.com (99.232.217.27[99.232.217.27]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:12 xxx64-017 proftpd[1534]: xxx64-017.xxxxx.com (82.216.96.10[82.216.96.10]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:22 xxx64-017 proftpd[1611]: xxx64-017.xxxxx.com (69.47.244.94[69.47.244.94]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:35 xxx64-017 proftpd[1764]: xxx64-017.xxxxx.com (24.7.209.181[24.7.209.181]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:47 xxx64-017 proftpd[1877]: xxx64-017.xxxxx.com (12.184.84.70[12.184.84.70]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:02 xxx64-017 proftpd[2029]: xxx64-017.xxxxx.com (142.169.117.13[142.169.117.13]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:20 xxx64-017 proftpd[2270]: xxx64-017.xxxxx.com (63.25.207.208[63.25.207.208]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:36 xxx64-017 proftpd[2415]: xxx64-017.xxxxx.com (98.215.200.195[98.215.200.195]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:52 xxx64-017 proftpd[2528]: xxx64-017.xxxxx.com (75.24.144.189[75.24.144.189]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:04 xxx64-017 proftpd[2659]: xxx64-017.xxxxx.com (74.216.90.139[74.216.90.139]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:19 xxx64-017 proftpd[2793]: xxx64-017.xxxxx.com (24.205.130.139[24.205.130.139]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:26 xxx64-017 proftpd[2882]: xxx64-017.xxxxx.com (97.101.151.56[97.101.151.56]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:41 xxx64-017 proftpd[3084]: xxx64-017.xxxxx.com (84.139.76.33[84.139.76.33]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:58 xxx64-017 proftpd[3178]: xxx64-017.xxxxx.com (173.2.73.42[173.2.73.42]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:06 xxx64-017 proftpd[3524]: xxx64-017.xxxxx.com (81.226.210.48[81.226.210.48]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:15 xxx64-017 proftpd[3589]: xxx64-017.xxxxx.com (77.98.173.109[77.98.173.109]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:25 xxx64-017 proftpd[3675]: xxx64-017.xxxxx.com (80.192.253.89[80.192.253.89]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:36 xxx64-017 proftpd[3771]: xxx64-017.xxxxx.com (99.234.48.99[99.234.48.99]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:11 xxx64-017 proftpd[4055]: xxx64-017.xxxxx.com (4.234.33.144[4.234.33.144]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:28 xxx64-017 proftpd[4237]: xxx64-017.xxxxx.com (97.93.105.138[97.93.105.138]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:45 xxx64-017 proftpd[4402]: xxx64-017.xxxxx.com (71.224.55.138[71.224.55.138]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:53 xxx64-017 proftpd[4488]: xxx64-017.xxxxx.com (86.20.53.26[86.20.53.26]) - USER semxxxxxxx: Login successful.
Jun 9 16:12:03 xxx64-017 proftpd[4625]: xxx64-017.xxxxx.com (62.84.5.145[62.84.5.145]) - USER semxxxxxxx: Login successful.
Jun 9 16:12:17 xxx64-017 proftpd[4717]: xxx64-017.xxxxx.com (122.107.111.68[122.107.111.68]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:00 xxx64-017 proftpd[14559]: xxx64-017.xxxxx.com (89.243.145.213[89.243.145.213]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:10 xxx64-017 proftpd[14663]: xxx64-017.xxxxx.com (86.24.215.183[86.24.215.183]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:21 xxx64-017 proftpd[14712]: xxx64-017.xxxxx.com (69.1.54.242[69.1.54.242]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:40 xxx64-017 proftpd[14774]: xxx64-017.xxxxx.com (71.80.107.161[71.80.107.161]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:49 xxx64-017 proftpd[14820]: xxx64-017.xxxxx.com (173.26.74.236[173.26.74.236]) - USER semxxxxxxx: Login successful.
Jun 8 05:12:57 xxx64-017 proftpd[14856]: xxx64-017.xxxxx.com (68.46.37.54[68.46.37.54]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:05 xxx64-017 proftpd[14906]: xxx64-017.xxxxx.com (69.76.90.157[69.76.90.157]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:14 xxx64-017 proftpd[14956]: xxx64-017.xxxxx.com (70.161.13.56[70.161.13.56]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:24 xxx64-017 proftpd[15000]: xxx64-017.xxxxx.com (71.74.126.136[71.74.126.136]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:35 xxx64-017 proftpd[15056]: xxx64-017.xxxxx.com (67.38.0.218[67.38.0.218]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:47 xxx64-017 proftpd[15104]: xxx64-017.xxxxx.com (216.215.128.96[216.215.128.96]) - USER semxxxxxxx: Login successful.
Jun 8 05:13:58 xxx64-017 proftpd[15150]: xxx64-017.xxxxx.com (64.231.21.139[64.231.21.139]) - USER semxxxxxxx: Login successful.
Jun 8 05:14:10 xxx64-017 proftpd[15259]: xxx64-017.xxxxx.com (82.2.142.36[82.2.142.36]) - USER semxxxxxxx: Login successful.
Jun 8 15:53:06 xxx64-017 proftpd[23848]: xxx64-017.xxxxx.com (75.208.83.242[75.208.83.242]) - USER semxxxxxxx (Login failed): Incorrect password.
Jun 8 17:54:55 xxx64-017 proftpd[25863]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:55:24 xxx64-017 proftpd[26233]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:56:44 xxx64-017 proftpd[26839]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:56:47 xxx64-017 proftpd[26879]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:57:13 xxx64-017 proftpd[27111]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:57:35 xxx64-017 proftpd[27276]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:57:38 xxx64-017 proftpd[27320]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:18 xxx64-017 proftpd[27612]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:21 xxx64-017 proftpd[27650]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:32 xxx64-017 proftpd[27715]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:58:36 xxx64-017 proftpd[27754]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:59:03 xxx64-017 proftpd[27948]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:59:05 xxx64-017 proftpd[27991]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 17:59:08 xxx64-017 proftpd[28029]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:00 xxx64-017 proftpd[28430]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:04 xxx64-017 proftpd[30582]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:08 xxx64-017 proftpd[30754]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:13 xxx64-017 proftpd[30805]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:28 xxx64-017 proftpd[30911]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:34 xxx64-017 proftpd[30962]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:37 xxx64-017 proftpd[31001]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:39 xxx64-017 proftpd[31034]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:51 xxx64-017 proftpd[31124]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:00:59 xxx64-017 proftpd[31187]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:15 xxx64-017 proftpd[31297]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:18 xxx64-017 proftpd[31340]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:44 xxx64-017 proftpd[31534]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:01:47 xxx64-017 proftpd[31588]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:02:52 xxx64-017 proftpd[32122]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:02:54 xxx64-017 proftpd[32166]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:02 xxx64-017 proftpd[32245]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:05 xxx64-017 proftpd[32285]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:17 xxx64-017 proftpd[32376]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:20 xxx64-017 proftpd[32420]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:03:25 xxx64-017 proftpd[32472]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:06 xxx64-017 proftpd[318]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:09 xxx64-017 proftpd[405]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:11 xxx64-017 proftpd[471]: xxx64-017.xxxxx.com (69.119.0.106[69.119.0.106]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:16 xxx64-017 proftpd[525]: xxx64-017.xxxxx.com (24.185.138.61[24.185.138.61]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:22 xxx64-017 proftpd[583]: xxx64-017.xxxxx.com (24.184.197.118[24.184.197.118]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:29 xxx64-017 proftpd[659]: xxx64-017.xxxxx.com (68.32.38.86[68.32.38.86]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:39 xxx64-017 proftpd[748]: xxx64-017.xxxxx.com (174.144.169.185[174.144.169.185]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:49 xxx64-017 proftpd[906]: xxx64-017.xxxxx.com (24.62.246.22[24.62.246.22]) - USER semxxxxxxx: Login successful.
Jun 8 18:04:59 xxx64-017 proftpd[977]: xxx64-017.xxxxx.com (68.76.103.151[68.76.103.151]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:06 xxx64-017 proftpd[1224]: xxx64-017.xxxxx.com (66.233.187.1[66.233.187.1]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:15 xxx64-017 proftpd[1325]: xxx64-017.xxxxx.com (88.174.41.21[88.174.41.21]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:25 xxx64-017 proftpd[1398]: xxx64-017.xxxxx.com (68.230.162.230[68.230.162.230]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:33 xxx64-017 proftpd[1480]: xxx64-017.xxxxx.com (68.230.162.230[68.230.162.230]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:40 xxx64-017 proftpd[1544]: xxx64-017.xxxxx.com (68.46.37.54[68.46.37.54]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:47 xxx64-017 proftpd[1618]: xxx64-017.xxxxx.com (76.198.235.246[76.198.235.246]) - USER semxxxxxxx: Login successful.
Jun 8 18:05:53 xxx64-017 proftpd[1736]: xxx64-017.xxxxx.com (67.8.85.126[67.8.85.126]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:05 xxx64-017 proftpd[1963]: xxx64-017.xxxxx.com (76.84.66.25[76.84.66.25]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:25 xxx64-017 proftpd[2158]: xxx64-017.xxxxx.com (99.234.221.235[99.234.221.235]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:41 xxx64-017 proftpd[2275]: xxx64-017.xxxxx.com (68.53.0.30[68.53.0.30]) - USER semxxxxxxx: Login successful.
Jun 8 18:06:52 xxx64-017 proftpd[2389]: xxx64-017.xxxxx.com (173.2.38.29[173.2.38.29]) - USER semxxxxxxx: Login successful.
Jun 8 18:07:04 xxx64-017 proftpd[2454]: xxx64-017.xxxxx.com (76.31.144.86[76.31.144.86]) - USER semxxxxxxx: Login successful.
Jun 9 13:39:51 xxx64-017 proftpd[16947]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 13:45:46 xxx64-017 proftpd[19825]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 13:45:56 xxx64-017 proftpd[19970]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:08:06 xxx64-017 proftpd[32404]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:08:55 xxx64-017 proftpd[32653]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:12:48 xxx64-017 proftpd[2074]: xxx64-017.xxxxx.com (121.141.142.63[121.141.142.63]) - USER semxxxxxxx (Login failed): Incorrect password.
Jun 9 14:12:53 xxx64-017 proftpd[2103]: xxx64-017.xxxxx.com (121.141.142.63[121.141.142.63]) - USER semxxxxxxx: Login successful.
Jun 9 14:17:35 xxx64-017 proftpd[4381]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:18:07 xxx64-017 proftpd[4677]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:28:16 xxx64-017 proftpd[9268]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:30:03 xxx64-017 sshd[9877]: Accepted password for semxxxxxxx from ::ffff:121.141.139.23 port 58647 ssh2
Jun 9 14:34:42 xxx64-017 proftpd[12475]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:34:42 xxx64-017 proftpd[12476]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 14:34:42 xxx64-017 proftpd[12477]: xxx64-017.xxxxx.com (121.141.139.23[121.141.139.23]) - USER semxxxxxxx: Login successful.
Jun 9 15:44:57 xxx64-017 proftpd[18354]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:20 xxx64-017 proftpd[31249]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:24 xxx64-017 proftpd[31292]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:28 xxx64-017 proftpd[31335]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:37 xxx64-017 proftpd[31417]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:46 xxx64-017 proftpd[31494]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:48 xxx64-017 proftpd[31545]: xxx64-017.xxxxx.com (75.32.62.148[75.32.62.148]) - USER semxxxxxxx: Login successful.
Jun 9 16:03:59 xxx64-017 proftpd[31644]: xxx64-017.xxxxx.com (72.235.99.253[72.235.99.253]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:09 xxx64-017 proftpd[31862]: xxx64-017.xxxxx.com (142.169.117.13[142.169.117.13]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:19 xxx64-017 proftpd[31960]: xxx64-017.xxxxx.com (87.192.227.111[87.192.227.111]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:27 xxx64-017 proftpd[32035]: xxx64-017.xxxxx.com (174.48.228.61[174.48.228.61]) - USER semxxxxxxx: Login successful.
Jun 9 16:04:53 xxx64-017 proftpd[32279]: xxx64-017.xxxxx.com (75.251.42.6[75.251.42.6]) - USER semxxxxxxx: Login successful.
Jun 9 16:05:26 xxx64-017 proftpd[351]: xxx64-017.xxxxx.com (75.45.83.141[75.45.83.141]) - USER semxxxxxxx: Login successful.
Jun 9 16:05:37 xxx64-017 proftpd[467]: xxx64-017.xxxxx.com (85.87.76.153[85.87.76.153]) - USER semxxxxxxx: Login successful.
Jun 9 16:05:53 xxx64-017 proftpd[602]: xxx64-017.xxxxx.com (203.221.31.44[203.221.31.44]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:01 xxx64-017 proftpd[800]: xxx64-017.xxxxx.com (68.53.175.252[68.53.175.252]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:11 xxx64-017 proftpd[892]: xxx64-017.xxxxx.com (66.41.176.62[66.41.176.62]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:19 xxx64-017 proftpd[969]: xxx64-017.xxxxx.com (173.33.3.65[173.33.3.65]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:29 xxx64-017 proftpd[1060]: xxx64-017.xxxxx.com (65.188.169.154[65.188.169.154]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:38 xxx64-017 proftpd[1127]: xxx64-017.xxxxx.com (173.81.194.69[173.81.194.69]) - USER semxxxxxxx: Login successful.
Jun 9 16:06:48 xxx64-017 proftpd[1215]: xxx64-017.xxxxx.com (24.99.136.140[24.99.136.140]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:05 xxx64-017 proftpd[1443]: xxx64-017.xxxxx.com (99.232.217.27[99.232.217.27]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:12 xxx64-017 proftpd[1534]: xxx64-017.xxxxx.com (82.216.96.10[82.216.96.10]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:22 xxx64-017 proftpd[1611]: xxx64-017.xxxxx.com (69.47.244.94[69.47.244.94]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:35 xxx64-017 proftpd[1764]: xxx64-017.xxxxx.com (24.7.209.181[24.7.209.181]) - USER semxxxxxxx: Login successful.
Jun 9 16:07:47 xxx64-017 proftpd[1877]: xxx64-017.xxxxx.com (12.184.84.70[12.184.84.70]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:02 xxx64-017 proftpd[2029]: xxx64-017.xxxxx.com (142.169.117.13[142.169.117.13]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:20 xxx64-017 proftpd[2270]: xxx64-017.xxxxx.com (63.25.207.208[63.25.207.208]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:36 xxx64-017 proftpd[2415]: xxx64-017.xxxxx.com (98.215.200.195[98.215.200.195]) - USER semxxxxxxx: Login successful.
Jun 9 16:08:52 xxx64-017 proftpd[2528]: xxx64-017.xxxxx.com (75.24.144.189[75.24.144.189]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:04 xxx64-017 proftpd[2659]: xxx64-017.xxxxx.com (74.216.90.139[74.216.90.139]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:19 xxx64-017 proftpd[2793]: xxx64-017.xxxxx.com (24.205.130.139[24.205.130.139]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:26 xxx64-017 proftpd[2882]: xxx64-017.xxxxx.com (97.101.151.56[97.101.151.56]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:41 xxx64-017 proftpd[3084]: xxx64-017.xxxxx.com (84.139.76.33[84.139.76.33]) - USER semxxxxxxx: Login successful.
Jun 9 16:09:58 xxx64-017 proftpd[3178]: xxx64-017.xxxxx.com (173.2.73.42[173.2.73.42]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:06 xxx64-017 proftpd[3524]: xxx64-017.xxxxx.com (81.226.210.48[81.226.210.48]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:15 xxx64-017 proftpd[3589]: xxx64-017.xxxxx.com (77.98.173.109[77.98.173.109]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:25 xxx64-017 proftpd[3675]: xxx64-017.xxxxx.com (80.192.253.89[80.192.253.89]) - USER semxxxxxxx: Login successful.
Jun 9 16:10:36 xxx64-017 proftpd[3771]: xxx64-017.xxxxx.com (99.234.48.99[99.234.48.99]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:11 xxx64-017 proftpd[4055]: xxx64-017.xxxxx.com (4.234.33.144[4.234.33.144]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:28 xxx64-017 proftpd[4237]: xxx64-017.xxxxx.com (97.93.105.138[97.93.105.138]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:45 xxx64-017 proftpd[4402]: xxx64-017.xxxxx.com (71.224.55.138[71.224.55.138]) - USER semxxxxxxx: Login successful.
Jun 9 16:11:53 xxx64-017 proftpd[4488]: xxx64-017.xxxxx.com (86.20.53.26[86.20.53.26]) - USER semxxxxxxx: Login successful.
Jun 9 16:12:03 xxx64-017 proftpd[4625]: xxx64-017.xxxxx.com (62.84.5.145[62.84.5.145]) - USER semxxxxxxx: Login successful.
Jun 9 16:12:17 xxx64-017 proftpd[4717]: xxx64-017.xxxxx.com (122.107.111.68[122.107.111.68]) - USER semxxxxxxx: Login successful.
