Kid-control "activity" field

Hi,

if you configure kid-control, you can get interesting data on device usage by running

/ip kid-control device print activity

I was wondering how exactly this field is filled? In most cases, it seems to be a FQDN, but not in all cases. So… Where does this come from?

THX & Cheers,
Toby.