diff --git a/protocols/nefarious.py b/protocols/nefarious.py
index 69a5705..4d46a3f 100644
--- a/protocols/nefarious.py
+++ b/protocols/nefarious.py
@@ -349,7 +349,7 @@ class P10Protocol(Protocol):
             ts, ident, host = args[2:5]
 
             # XXX: Is realhost ever sent?
-            realhost = None
+            realhost = host
 
             # Thanks to Jobe @ evilnet for the code on what to do here. :) -GL
             ip = args[-3]