That would probably be the isp of the user trying to connect. Either that or it's an ftp bot scouring the net. By the way you can fake hostmasks.