Hi there
here is my log
system,error,critical login failure for user Open from 212.100.64.11 via ftp
ftp server are already disable but still i found the error
how to block host and port from wan interface
That is just a hacker trying to get into your box to upload some malicious code that will screw up your life. No thing. Happens hundreds of times a day here.
If you want to stop it, take a look at the section on “How to Protect Your Router” near the bottom of the page here. http://www.mikrotik.com/testdocs/ros/2.9/ip/filter.php
ADD: I will help you protect yourself from a hacker, but I will not help you become one. That is the reason I did not answer the other post. It is an ethics deal for me. I offer no apology.
here is a tutorial how to prevent this:
http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention