I'm at work at the moment so I'm not going to bust out and check out the ip like I would if I was at home, but I just wanted to add my two cents. If this IP has been used to attack other accounts and other sites, and yet for some reason is running an ftp server and a server of some sort on port 80, the computer at that ip has probably been hacked itself and is being used to remotely attack sites.