I) Hacking in xx.xx.xx ======================= The following Linux hosts are hacked at ~03:50 AM on 16th Jan 01 via ftp vulnerability. xx.xx.xx.116 xx.xx.xx.120 xx.xx.xx.124 xx.xx.xx.148 Three of them are managed by students. After the break-ins, these hosts were used to syn-scan ftp port of the following networks: 216.97/16 51.251/16 144.195/16 Once the hacker broke into the hosts, he/she started to syn-scan other networks within 4 to 34 seconds. See the router netflow data log attached at the end of this docutment. Start Time End Time Src host Dst host Prt Src port Dst port no. of pkg Octets ==================================================================================================================================== 0116.03:48:56.432 0116.03:48:59.492 xx.xx.xx.148 137.189.192.3 11 1026( ) 53 ( domain ) 3 213 0116.03:48:56.432 0116.03:48:59.492 xx.xx.xx.148 137.189.196.3 11 1026( ) 53 ( domain ) 3 213 0116.03:48:55.992 0116.03:48:55.992 xx.xx.xx.148 yy.yy.37.89 06 21( ftp ) 3046 ( ) 1 60 0116.03:48:59.512 0116.03:48:59.744 xx.xx.xx.148 yy.yy.37.89 06 21( ftp ) 3046 ( ) 4 344 0116.03:48:55.760 0116.03:48:55.760 xx.xx.xx.148 yy.yy.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:55:15.716 0116.03:55:15.716 xx.xx.xx.148 yy.yy.37.89 06 21( ftp ) 4559 ( ) 1 60 0116.03:55:15.968 0116.03:55:18.980 xx.xx.xx.148 yy.yy.196.3 11 1026( ) 53 ( domain ) 3 213 0116.03:55:46.100 0116.03:55:47.988 xx.xx.xx.148 yy.yy.37.89 06 1025(blackjack) 27374 ( ) 39 2578 0116.03:55:56.1000 0116.03:55:56.1000 xx.xx.xx.148 212.97.1.3 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:56.976 0116.03:55:56.976 xx.xx.xx.148 212.97.1.2 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:57.108 0116.03:55:57.108 xx.xx.xx.148 212.97.1.5 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:57.16 0116.03:55:57.16 xx.xx.xx.148 212.97.1.4 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:57.148 0116.03:55:57.148 xx.xx.xx.148 212.97.1.7 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:57.128 0116.03:55:57.128 xx.xx.xx.148 212.97.1.6 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:53.208 0116.03:55:53.208 xx.xx.xx.148 212.97.0.73 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:55:53.188 0116.03:55:53.188 xx.xx.xx.148 212.97.0.72 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:58.632 0116.03:48:58.860 xx.xx.xx.116 yy.yy.37.89 06 21( ftp ) 3030 ( ) 4 345 0116.03:48:55.340 0116.03:48:55.340 xx.xx.xx.116 yy.yy.37.89 06 21( ftp ) 3030 ( ) 1 60 0116.03:48:55.112 0116.03:48:55.112 xx.xx.xx.116 yy.yy.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:50:58.72 0116.03:51:01.92 xx.xx.xx.116 137.189.196.3 11 1025(blackjack) 53 ( domain ) 3 213 0116.03:50:57.820 0116.03:50:57.820 xx.xx.xx.116 yy.yy.37.89 06 21( ftp ) 3458 ( ) 1 60 0116.03:51:30.180 0116.03:51:31.1000 xx.xx.xx.116 yy.yy.37.89 06 1029( ) 27374 ( ) 39 3029 0116.03:51:34.840 0116.03:51:34.840 xx.xx.xx.116 51.251.0.51 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.820 0116.03:51:34.820 xx.xx.xx.116 51.251.0.50 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.800 0116.03:51:34.800 xx.xx.xx.116 51.251.0.49 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.780 0116.03:51:34.780 xx.xx.xx.116 51.251.0.48 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.928 0116.03:51:34.928 xx.xx.xx.116 51.251.0.55 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.908 0116.03:51:34.908 xx.xx.xx.116 51.251.0.54 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.896 0116.03:51:34.896 xx.xx.xx.116 51.251.0.53 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.860 0116.03:51:34.860 xx.xx.xx.116 51.251.0.52 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:35.8 0116.03:51:35.8 xx.xx.xx.116 51.251.0.59 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:51:34.988 0116.03:51:34.988 xx.xx.xx.116 51.251.0.58 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:58.912 0116.03:48:59.144 xx.xx.xx.120 yy.yy.37.89 06 21( ftp ) 3032 ( ) 4 342 0116.03:48:55.424 0116.03:48:55.424 xx.xx.xx.120 yy.yy.37.89 06 21( ftp ) 3032 ( ) 1 60 0116.03:48:55.192 0116.03:48:55.192 xx.xx.xx.120 yy.yy.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:53:06.1000 0116.03:53:10.20 xx.xx.xx.120 137.189.196.3 11 1025(blackjack) 53 ( domain ) 3 213 0116.03:53:06.752 0116.03:53:06.752 xx.xx.xx.120 yy.yy.37.89 06 21( ftp ) 3973 ( ) 1 60 0116.03:53:40.176 0116.03:53:40.176 xx.xx.xx.120 144.195.0.7 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.156 0116.03:53:40.156 xx.xx.xx.120 144.195.0.6 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.136 0116.03:53:40.136 xx.xx.xx.120 144.195.0.5 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.116 0116.03:53:40.116 xx.xx.xx.120 144.195.0.4 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.96 0116.03:53:40.96 xx.xx.xx.120 144.195.0.3 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.76 0116.03:53:40.76 xx.xx.xx.120 144.195.0.2 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.336 0116.03:53:40.336 xx.xx.xx.120 144.195.0.15 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.316 0116.03:53:40.316 xx.xx.xx.120 144.195.0.14 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.296 0116.03:53:40.296 xx.xx.xx.120 144.195.0.13 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.276 0116.03:53:40.276 xx.xx.xx.120 144.195.0.12 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.256 0116.03:53:40.256 xx.xx.xx.120 144.195.0.11 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.236 0116.03:53:40.236 xx.xx.xx.120 144.195.0.10 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.216 0116.03:53:40.216 xx.xx.xx.120 144.195.0.9 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.196 0116.03:53:40.196 xx.xx.xx.120 144.195.0.8 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:53:40.496 0116.03:53:40.496 xx.xx.xx.120 144.195.0.23 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:59.792 0116.03:49:00.40 xx.xx.xx.124 yy.yy.37.89 06 21( ftp ) 3034 ( ) 4 323 0116.03:48:55.504 0116.03:48:55.504 xx.xx.xx.124 yy.yy.37.89 06 21( ftp ) 3034 ( ) 1 60 0116.03:48:55.272 0116.03:48:55.272 xx.xx.xx.124 yy.yy.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:25.948 0116.03:49:25.948 xx.xx.xx.124 205.188.153.105 11 1103( ) 4000 ( ) 2 112 0116.03:51:28.668 0116.03:51:28.668 xx.xx.xx.124 205.188.153.105 11 1103( ) 4000 ( ) 2 112 0116.03:52:51.204 0116.03:53:31.260 xx.xx.xx.124 205.188.153.105 11 1103( ) 4000 ( ) 3 168 0116.03:55:31.476 0116.03:55:31.476 xx.xx.xx.124 205.188.153.105 11 1103( ) 4000 ( ) 2 112 0116.03:57:25.288 0116.03:57:28.348 xx.xx.xx.124 137.189.192.3 11 1104( ) 53 ( domain ) 4 286 0116.03:57:25.292 0116.03:57:28.328 xx.xx.xx.124 137.189.196.3 11 1104( ) 53 ( domain ) 3 213 0116.03:57:34.196 0116.03:57:34.196 xx.xx.xx.124 205.188.153.105 11 1103( ) 4000 ( ) 2 112 0116.03:57:28.352 0116.03:57:34.176 xx.xx.xx.124 216.97.37.89 06 21( ftp ) 1111 ( ) 10 2235 0116.03:57:24.716 0116.03:57:24.716 xx.xx.xx.124 216.97.37.89 06 21( ftp ) 1111 ( ) 1 60 0116.03:58:18.512 0116.03:58:18.776 xx.xx.xx.124 216.97.37.89 06 21( ftp ) 1111 ( ) 8 9531 0116.03:48:59.708 0116.03:49:00.68 xx.xx.xx.72 yy.97.37.89 06 21( ftp ) 3022 ( ) 4 273 0116.03:48:54.780 0116.03:49:00.372 xx.xx.xx.86 yy.97.37.89 06 21( ftp ) 3023 ( ) 3 164 0116.03:48:54.808 0116.03:49:00.564 xx.xx.xx.87 yy.97.37.89 06 21( ftp ) 3024 ( ) 3 164 0116.03:48:54.448 0116.03:48:54.448 xx.xx.xx.72 yy.97.37.89 06 21( ftp ) 3022 ( ) 1 44 0116.03:48:54.940 0116.03:48:55.496 xx.xx.xx.94 yy.97.37.89 06 21( ftp ) 3025 ( ) 4 274 0116.03:48:54.336 0116.03:48:54.776 xx.xx.xx.66 yy.97.37.89 06 21( ftp ) 3021 ( ) 4 277 0116.03:48:58.912 0116.03:48:59.144 xx.xx.xx.120 yy.97.37.89 06 21( ftp ) 3032 ( ) 4 342 0116.03:49:00.756 0116.03:49:01.28 xx.xx.xx.117 yy.97.37.89 06 21( ftp ) 3031 ( ) 4 324 0116.03:48:58.632 0116.03:48:58.860 xx.xx.xx.116 yy.97.37.89 06 21( ftp ) 3030 ( ) 4 345 0116.03:48:59.792 0116.03:49:00.40 xx.xx.xx.124 yy.97.37.89 06 21( ftp ) 3034 ( ) 4 323 0116.03:48:55.72 0116.03:48:55.740 xx.xx.xx.100 yy.97.37.89 06 21( ftp ) 3026 ( ) 4 215 0116.03:48:55.92 0116.03:48:55.528 xx.xx.xx.104 yy.97.37.89 06 21( ftp ) 3027 ( ) 4 218 0116.03:48:55.212 0116.03:48:55.936 xx.xx.xx.110 yy.97.37.89 06 21( ftp ) 3028 ( ) 5 265 0116.03:48:55.424 0116.03:48:55.424 xx.xx.xx.120 yy.97.37.89 06 21( ftp ) 3032 ( ) 1 60 0116.03:48:55.476 0116.03:48:55.948 xx.xx.xx.123 yy.97.37.89 06 21( ftp ) 3033 ( ) 4 270 0116.03:48:55.352 0116.03:48:55.352 xx.xx.xx.117 yy.97.37.89 06 21( ftp ) 3031 ( ) 1 60 0116.03:48:55.340 0116.03:48:55.340 xx.xx.xx.116 yy.97.37.89 06 21( ftp ) 3030 ( ) 1 60 0116.03:48:55.572 0116.03:48:55.572 xx.xx.xx.127 yy.97.37.89 06 21( ftp ) 3035 ( ) 1 60 0116.03:48:55.504 0116.03:48:55.504 xx.xx.xx.124 yy.97.37.89 06 21( ftp ) 3034 ( ) 1 60 0116.03:48:55.320 0116.03:48:55.780 xx.xx.xx.115 yy.97.37.89 06 21( ftp ) 3029 ( ) 3 169 0116.03:48:57.944 0116.03:48:58.204 xx.xx.xx.2 yy.97.37.89 06 21( ftp ) 3020 ( ) 4 344 0116.03:48:53.64 0116.03:48:53.64 xx.xx.xx.2 yy.97.37.89 06 21( ftp ) 3020 ( ) 1 60 0116.03:48:55.744 0116.03:48:55.744 xx.xx.xx.135 yy.97.37.89 06 21( ftp ) 3039 ( ) 1 44 0116.03:48:55.724 0116.03:48:56.220 xx.xx.xx.134 yy.97.37.89 06 21( ftp ) 3038 ( ) 4 269 0116.03:48:55.708 0116.03:48:56.268 xx.xx.xx.131 yy.97.37.89 06 21( ftp ) 3037 ( ) 4 267 0116.03:48:55.632 0116.03:48:56.96 xx.xx.xx.130 yy.97.37.89 06 21( ftp ) 3036 ( ) 4 202 0116.03:48:56.276 0116.03:48:56.748 xx.xx.xx.162 yy.97.37.89 06 21( ftp ) 3047 ( ) 4 300 0116.03:48:56.36 0116.03:48:56.276 xx.xx.xx.135 yy.97.37.89 06 21( ftp ) 3039 ( ) 4 243 0116.03:48:55.992 0116.03:48:55.992 xx.xx.xx.148 yy.97.37.89 06 21( ftp ) 3046 ( ) 1 60 0116.03:48:55.988 0116.03:48:56.476 xx.xx.xx.147 yy.97.37.89 06 21( ftp ) 3045 ( ) 4 210 0116.03:48:59.512 0116.03:48:59.744 xx.xx.xx.148 yy.97.37.89 06 21( ftp ) 3046 ( ) 4 344 0116.03:48:55.748 0116.03:48:56.308 xx.xx.xx.133 yy.97.37.89 06 21( ftp ) 3040 ( ) 4 213 0116.03:48:55.760 0116.03:48:56.224 xx.xx.xx.136 yy.97.37.89 06 21( ftp ) 3041 ( ) 4 212 0116.03:48:55.892 0116.03:48:55.892 xx.xx.xx.143 yy.97.37.89 06 21( ftp ) 3044 ( ) 1 60 0116.03:48:55.876 0116.03:48:56.332 xx.xx.xx.142 yy.97.37.89 06 21( ftp ) 3043 ( ) 4 267 0116.03:48:55.872 0116.03:49:01.992 xx.xx.xx.141 yy.97.37.89 06 21( ftp ) 3042 ( ) 4 352 0116.03:48:55.440 0116.03:48:55.440 xx.xx.xx.132 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:55.464 0116.03:48:55.464 xx.xx.xx.133 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.480 0116.03:48:55.480 xx.xx.xx.134 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.500 0116.03:48:55.500 xx.xx.xx.135 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.396 0116.03:48:55.396 xx.xx.xx.130 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.424 0116.03:48:55.424 xx.xx.xx.131 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.600 0116.03:48:55.600 xx.xx.xx.140 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:55.624 0116.03:48:55.624 xx.xx.xx.141 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.640 0116.03:48:55.640 xx.xx.xx.142 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.660 0116.03:48:55.660 xx.xx.xx.143 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.524 0116.03:48:55.524 xx.xx.xx.136 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.560 0116.03:48:55.560 xx.xx.xx.138 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:55.760 0116.03:48:55.760 xx.xx.xx.148 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.744 0116.03:48:55.744 xx.xx.xx.147 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:56.124 0116.03:48:56.124 xx.xx.xx.166 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:56.44 0116.03:48:56.44 xx.xx.xx.162 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.708 0116.03:48:55.708 xx.xx.xx.129 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:59.464 0116.03:48:59.464 xx.xx.xx.238 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:57.464 0116.03:48:57.464 xx.xx.xx.233 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:57.488 0116.03:48:57.488 xx.xx.xx.234 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:57.508 0116.03:48:57.508 xx.xx.xx.235 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:52.976 0116.03:48:52.976 xx.xx.xx.9 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:53.12 0116.03:48:53.12 xx.xx.xx.11 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:53.260 0116.03:48:53.260 xx.xx.xx.23 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.56 0116.03:48:54.56 xx.xx.xx.63 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.156 0116.03:48:54.156 xx.xx.xx.68 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.168 0116.03:48:54.168 xx.xx.xx.69 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.192 0116.03:48:54.192 xx.xx.xx.70 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.212 0116.03:48:54.212 xx.xx.xx.71 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.112 0116.03:48:54.112 xx.xx.xx.66 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.316 0116.03:48:54.316 xx.xx.xx.76 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.332 0116.03:48:54.332 xx.xx.xx.77 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.352 0116.03:48:54.352 xx.xx.xx.78 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.228 0116.03:48:54.228 xx.xx.xx.72 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.252 0116.03:48:54.252 xx.xx.xx.73 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.476 0116.03:48:54.476 xx.xx.xx.84 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.512 0116.03:48:54.512 xx.xx.xx.86 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.532 0116.03:48:54.532 xx.xx.xx.87 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.416 0116.03:48:54.416 xx.xx.xx.81 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.432 0116.03:48:54.432 xx.xx.xx.82 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.452 0116.03:48:54.452 xx.xx.xx.83 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.652 0116.03:48:54.652 xx.xx.xx.93 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.672 0116.03:48:54.672 xx.xx.xx.94 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.552 0116.03:48:54.552 xx.xx.xx.88 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.796 0116.03:48:54.796 xx.xx.xx.100 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.812 0116.03:48:54.812 xx.xx.xx.101 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.856 0116.03:48:54.856 xx.xx.xx.103 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.756 0116.03:48:54.756 xx.xx.xx.98 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.976 0116.03:48:54.976 xx.xx.xx.109 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:54.988 0116.03:48:54.988 xx.xx.xx.110 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:54.868 0116.03:48:54.868 xx.xx.xx.104 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.112 0116.03:48:55.112 xx.xx.xx.116 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.128 0116.03:48:55.128 xx.xx.xx.117 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.172 0116.03:48:55.172 xx.xx.xx.119 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:48:55.88 0116.03:48:55.88 xx.xx.xx.115 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.272 0116.03:48:55.272 xx.xx.xx.124 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.336 0116.03:48:55.336 xx.xx.xx.127 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.192 0116.03:48:55.192 xx.xx.xx.120 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:55.248 0116.03:48:55.248 xx.xx.xx.123 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:48:56.772 0116.03:48:59.772 xx.xx.xx.141 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:48:54.684 0116.03:48:55.340 xx.xx.xx.72 yy.97.37.89 06 31751( ) 113 ( auth ) 6 253 0116.03:49:11.976 0116.03:49:14.972 137.189.97.115 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:49:07.284 0116.03:49:10.284 137.189.96.142 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:49:07.824 0116.03:49:10.828 137.189.96.138 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:49:07.564 0116.03:49:10.564 137.189.96.149 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:49:09.544 0116.03:49:12.540 137.189.96.223 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:49:09.300 0116.03:49:12.300 137.189.96.101 yy.97.37.89 11 137(netbios-n) 137 (netbios-n) 3 234 0116.03:49:16.348 0116.03:49:16.348 137.189.98.158 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:17.308 0116.03:49:17.308 137.189.98.206 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:17.272 0116.03:49:17.272 137.189.98.204 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:17.288 0116.03:49:17.288 137.189.98.205 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:17.240 0116.03:49:17.240 137.189.98.202 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:17.252 0116.03:49:17.252 137.189.98.203 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:13.624 0116.03:49:13.624 137.189.98.21 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:15.340 0116.03:49:15.340 137.189.98.107 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.864 0116.03:49:05.864 137.189.96.129 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.844 0116.03:49:05.844 137.189.96.142 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:05.960 0116.03:49:05.960 137.189.96.143 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.844 0116.03:49:05.844 137.189.96.140 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.844 0116.03:49:05.844 137.189.96.138 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:05.844 0116.03:49:05.844 137.189.96.136 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.992 0116.03:49:05.992 137.189.96.150 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.976 0116.03:49:05.976 137.189.96.149 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:05.968 0116.03:49:05.968 137.189.96.146 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.964 0116.03:49:05.964 137.189.96.145 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:08.40 0116.03:49:08.40 137.189.96.252 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.1000 0116.03:49:07.1000 137.189.96.250 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:06.36 0116.03:49:06.36 137.189.96.152 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:06.428 0116.03:49:06.428 137.189.96.172 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:06.392 0116.03:49:06.392 137.189.96.170 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:07.112 0116.03:49:07.112 137.189.96.206 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.68 0116.03:49:07.68 137.189.96.204 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.8 0116.03:49:07.8 137.189.96.201 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.196 0116.03:49:07.196 137.189.96.210 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.208 0116.03:49:07.208 137.189.96.211 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:07.156 0116.03:49:07.156 137.189.96.208 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.452 0116.03:49:07.452 137.189.96.223 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:07.392 0116.03:49:07.392 137.189.96.220 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.328 0116.03:49:07.328 137.189.96.217 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.548 0116.03:49:07.548 137.189.96.228 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:07.476 0116.03:49:07.476 137.189.96.224 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:07.668 0116.03:49:07.668 137.189.96.234 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:08.372 0116.03:49:08.372 137.189.96.247 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:08.76 0116.03:49:08.76 137.189.96.254 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:08.16 0116.03:49:08.16 137.189.96.249 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:03.524 0116.03:49:03.524 137.189.96.19 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:05.268 0116.03:49:05.268 137.189.96.101 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:05.268 0116.03:49:05.268 137.189.96.104 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.268 0116.03:49:05.268 137.189.96.105 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.552 0116.03:49:05.552 137.189.96.118 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.552 0116.03:49:05.552 137.189.96.119 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.552 0116.03:49:05.552 137.189.96.116 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.552 0116.03:49:05.552 137.189.96.117 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.276 0116.03:49:05.276 137.189.96.112 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:05.556 0116.03:49:05.556 137.189.96.121 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:11.828 0116.03:49:11.828 137.189.97.187 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:12.16 0116.03:49:12.16 137.189.97.196 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:12.692 0116.03:49:12.692 137.189.97.230 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:12.668 0116.03:49:12.668 137.189.97.229 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:10.404 0116.03:49:10.404 137.189.97.115 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:10.652 0116.03:49:17.80 137.189.97.115 yy.97.37.89 06 21( ftp ) 3064 ( ) 4 389 0116.03:49:12.248 0116.03:49:12.248 137.189.97.196 yy.97.37.89 06 21( ftp ) 3066 ( ) 1 44 0116.03:49:12.976 0116.03:49:13.200 137.189.97.196 yy.97.37.89 06 21( ftp ) 3066 ( ) 4 259 0116.03:49:12.100 0116.03:49:12.632 137.189.97.187 yy.97.37.89 06 21( ftp ) 3065 ( ) 4 275 0116.03:49:05.500 0116.03:49:14.304 137.189.96.101 yy.97.37.89 06 21( ftp ) 3054 ( ) 4 353 0116.03:49:03.768 0116.03:49:04.248 137.189.96.19 yy.97.37.89 06 21( ftp ) 3053 ( ) 4 1105 0116.03:49:07.780 0116.03:49:08.244 137.189.96.228 yy.97.37.89 06 21( ftp ) 3063 ( ) 4 215 0116.03:49:07.444 0116.03:49:08.24 137.189.96.211 yy.97.37.89 06 21( ftp ) 3061 ( ) 4 270 0116.03:49:07.676 0116.03:49:08.944 137.189.96.223 yy.97.37.89 06 21( ftp ) 3062 ( ) 5 258 0116.03:49:06.612 0116.03:49:06.612 137.189.96.170 yy.97.37.89 06 21( ftp ) 3059 ( ) 1 60 0116.03:49:06.664 0116.03:49:06.664 137.189.96.172 yy.97.37.89 06 21( ftp ) 3060 ( ) 1 60 0116.03:49:11.652 0116.03:49:11.924 137.189.96.170 yy.97.37.89 06 21( ftp ) 3059 ( ) 4 343 0116.03:49:11.940 0116.03:49:12.172 137.189.96.172 yy.97.37.89 06 21( ftp ) 3060 ( ) 4 328 0116.03:49:06.112 0116.03:49:07.68 137.189.96.142 yy.97.37.89 06 21( ftp ) 3056 ( ) 5 257 0116.03:49:06.184 0116.03:49:06.624 137.189.96.145 yy.97.37.89 06 21( ftp ) 3057 ( ) 4 214 0116.03:49:06.252 0116.03:49:12.640 137.189.96.149 yy.97.37.89 06 21( ftp ) 3058 ( ) 4 341 0116.03:49:06.68 0116.03:49:08.208 137.189.96.138 yy.97.37.89 06 21( ftp ) 3055 ( ) 5 258 0116.03:49:13.908 0116.03:49:15.484 137.189.98.21 yy.97.37.89 06 21( ftp ) 3067 ( ) 5 304 0116.03:49:17.564 0116.03:49:17.564 137.189.98.205 yy.97.37.89 06 21( ftp ) 3069 ( ) 1 60 0116.03:49:17.464 0116.03:49:17.900 137.189.98.202 yy.97.37.89 06 21( ftp ) 3068 ( ) 4 270 0116.03:49:20.996 0116.03:49:20.996 137.189.99.133 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:21.316 0116.03:49:21.316 137.189.99.151 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.468 0116.03:49:21.468 137.189.99.158 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.476 0116.03:49:21.476 137.189.99.159 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.420 0116.03:49:21.420 137.189.99.156 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.428 0116.03:49:21.428 137.189.99.157 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.376 0116.03:49:21.376 137.189.99.154 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.404 0116.03:49:21.404 137.189.99.155 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.348 0116.03:49:21.348 137.189.99.152 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.368 0116.03:49:21.368 137.189.99.153 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.620 0116.03:49:21.620 137.189.99.166 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.648 0116.03:49:21.648 137.189.99.167 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.596 0116.03:49:21.596 137.189.99.165 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.576 0116.03:49:21.576 137.189.99.163 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.508 0116.03:49:21.508 137.189.99.160 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.520 0116.03:49:21.520 137.189.99.161 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.772 0116.03:49:21.772 137.189.99.174 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.792 0116.03:49:21.792 137.189.99.175 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.736 0116.03:49:21.736 137.189.99.171 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.660 0116.03:49:21.660 137.189.99.168 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.672 0116.03:49:21.672 137.189.99.169 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.932 0116.03:49:21.932 137.189.99.182 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.952 0116.03:49:21.952 137.189.99.183 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.916 0116.03:49:21.916 137.189.99.181 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.880 0116.03:49:21.880 137.189.99.179 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.824 0116.03:49:21.824 137.189.99.176 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.840 0116.03:49:21.840 137.189.99.177 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.100 0116.03:49:22.100 137.189.99.190 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.124 0116.03:49:22.124 137.189.99.191 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.52 0116.03:49:22.52 137.189.99.188 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.84 0116.03:49:22.84 137.189.99.189 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.16 0116.03:49:22.16 137.189.99.186 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.36 0116.03:49:22.36 137.189.99.187 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.976 0116.03:49:21.976 137.189.99.184 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:21.992 0116.03:49:21.992 137.189.99.185 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.272 0116.03:49:22.272 137.189.99.199 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.256 0116.03:49:22.256 137.189.99.197 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.204 0116.03:49:22.204 137.189.99.194 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.164 0116.03:49:22.164 137.189.99.193 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.368 0116.03:49:22.368 137.189.99.203 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.320 0116.03:49:22.320 137.189.99.200 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:22.620 0116.03:49:22.620 137.189.99.yy yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 44 0116.03:49:23.68 0116.03:49:23.68 137.189.99.238 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.384 0116.03:49:19.384 137.189.99.54 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.400 0116.03:49:19.400 137.189.99.55 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.348 0116.03:49:19.348 137.189.99.52 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.360 0116.03:49:19.360 137.189.99.53 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.320 0116.03:49:19.320 137.189.99.51 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.500 0116.03:49:19.500 137.189.99.60 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.460 0116.03:49:19.460 137.189.99.58 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.480 0116.03:49:19.480 137.189.99.59 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:19.444 0116.03:49:19.444 137.189.99.57 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:20.180 0116.03:49:20.180 137.189.99.94 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:20.120 0116.03:49:20.120 137.189.99.91 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:20.116 0116.03:49:20.116 137.189.99.89 yy.97.37.89 06 21( ftp ) 21 ( ftp ) 1 40 0116.03:49:27.932 0116.03:49:28.204 137.189.99.yy yy.97.37.89 06 21( ftp ) 3071 ( ) 4 341 0116.03:49:22.892 0116.03:49:22.892 137.189.99.yy yy.97.37.89 06 21( ftp ) 3071 ( ) 1 60 0116.03:49:21.268 0116.03:49:21.268 137.189.99.133 yy.97.37.89 06 21( ftp ) 3070 ( ) 1 60 0116.03:49:26.564 0116.03:49:26.872 137.189.99.133 yy.97.37.89 06 21( ftp ) 3070 ( ) 4 324 0116.03:49:23.824 0116.03:49:24.88 137.189.98.205 yy.97.37.89 06 21( ftp ) 3069 ( ) 4 341 0116.03:49:05.804 0116.03:49:46.768 xx.xx.xx.127 yy.97.37.89 06 21( ftp ) 3035 ( ) 3 292 0116.03:49:06.120 0116.03:49:44.760 xx.xx.xx.143 yy.97.37.89 06 21( ftp ) 3044 ( ) 3 292 0116.03:50:57.820 0116.03:50:57.820 xx.xx.xx.116 yy.97.37.89 06 21( ftp ) 3458 ( ) 1 60 0116.03:51:30.180 0116.03:51:31.1000 xx.xx.xx.116 yy.97.37.89 06 1029( ) 27374 ( ) 39 3029 0116.03:51:01.96 0116.03:52:09.600 xx.xx.xx.116 yy.97.37.89 06 21( ftp ) 3458 ( ) 16 2885 0116.03:53:06.752 0116.03:53:06.752 xx.xx.xx.120 yy.97.37.89 06 21( ftp ) 3973 ( ) 1 60 0116.03:53:37.40 0116.03:53:38.928 xx.xx.xx.120 yy.97.37.89 06 1025(blackjack) 27374 ( ) 39 2578 0116.03:53:10.20 0116.03:54:00.356 xx.xx.xx.120 yy.97.37.89 06 21( ftp ) 3973 ( ) 35 4789 0116.03:55:15.716 0116.03:55:15.716 xx.xx.xx.148 yy.97.37.89 06 21( ftp ) 4559 ( ) 1 60 0116.03:55:46.100 0116.03:55:47.988 xx.xx.xx.148 yy.97.37.89 06 1025(blackjack) 27374 ( ) 39 2578 0116.03:55:18.984 0116.03:55:55.392 xx.xx.xx.148 yy.97.37.89 06 21( ftp ) 4559 ( ) 17 2936 0116.03:57:28.352 0116.03:57:34.176 xx.xx.xx.124 yy.97.37.89 06 21( ftp ) 1111 ( ) 10 2235 0116.03:57:24.716 0116.03:57:24.716 xx.xx.xx.124 yy.97.37.89 06 21( ftp ) 1111 ( ) 1 60 0116.03:58:18.512 0116.03:58:18.776 xx.xx.xx.124 yy.97.37.89 06 21( ftp ) 1111 ( ) 8 9531 0116.03:59:34.172 0116.03:59:34.172 137.189.99.133 yy.97.37.89 06 21( ftp ) 1371 ( ) 1 60 0116.03:59:38.936 0116.03:59:49.824 137.189.99.133 yy.97.37.89 06 21( ftp ) 1371 ( ) 7 570