just finish my last observation, if http is open from inside to outside, you should take a look at "strict" parameters. That would avoid "embeded" ftp on http strings. Maybe this the origin from those ftp connections