it might be an ad, or a sig host...i know ive had something similar pop up when someone has hosted a signature on part of a server that needs a password.