[HECnet] Where is this login attempt coming from?

Just saw this on LABVAX: %%%%%%%%%%% OPCOM 30-NOV-2013 21:28:47.27 %%%%%%%%%%% Message from user AUDIT$SERVER on LABVAX Security alarm (SECURITY) and security audit (SECURITY) on LABVAX, system id: 48683 Auditable event: Local interactive login failure Event time: 30-NOV-2013 21:28:47.21 PID: 22E00220 Process name: _NTY215: Username: <login> Process owner: [SYSTEM] Terminal name: _NTY215:, 122.138.48.116.static.netvigator.com Image name: $77$DUA0:[SYS10.SYSCOMMON.][SYSEXE]LOGINOUT.EXE Status: %LOGIN-F-CMDINPUT, error reading command input Confused as it doesn't look like a telnet logon, I thought telnet terminal IDs were TN-something? sampsa <sampsa at mac.com> mobile +44 7961 149465