HI Guys,
Today I identified near same behaviour on one of our old servers (all changed files with date of 05/13/2013 more or less 01 AM) today.
Massive brute force to ftp server, and on some domains the same kind of archive.
No new domains created, only archives modified.
On compromised...