The tool they were downloading appears to have been private. Hence the anonymized IP and hostname (anti.sec.labs).