[HECnet] Where is this login attempt coming from?

[Sampsa Laine]

Just saw this on LABVAX:

%%%%%%%%%%%   OPCOM   30-NOV-2013 21:28:47.27   %%%%%%%%%%%
Message from user AUDIT$SERVER on LABVAX
Security alarm (SECURITY) and security audit (SECURITY) on LABVAX, system id: 48683
Auditable event:                   Local interactive login failure
Event time:                             30-NOV-2013 21:28:47.21
PID:                                           22E00220               
Process name:                         _NTY215:               
Username:                                 <login>                 
Process owner:                       [SYSTEM]
Terminal name:                       _NTY215:, 122.138.48.116.static.netvigator.com
Image name:                             $77$DUA0:[SYS10.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Status:                                     %LOGIN-F-CMDINPUT, error reading command input

Confused as it doesn't look like a telnet logon, I thought telnet terminal IDs were TN-something?

sampsa	<sampsa at mac.com>
mobile +44 7961 149465