Your site is being exposed to a vocabulary-based brute-force attack with an aim to steal the premium accounts which will be later used on debrid services. If migrating to Cloudflare CDN is not an option for you or doesn't helps, you have to take the following actions in order to protect:
1. Upgrade to v.3.2
2. Put 0 in admin_settings -> Show captcha after X failed logins/h to enable login captcha for everybody but white-listed IPs. We understand that you're worrying about end-user experience, but please note that specifying more permissive limits (like 1 or greater) most likely will not help.
3. Disable FTP access for all IPs but whitelisted by users
Handmade by talented professionals
Facebook
Twitter