SEP 12Ru3 GUP connecting to proxy server and port 2967 continuously

We configured a SEP 12RU3 gup and the port 2967 is working and updating clients. The LU policy is set to receive updates from itself . The "default managment server" box is selected. The GUP is set to "never bypass".

The network guys have monitored this GUP and for some strange reason the GUP is connecting to the internet proxy server on the same  port 2967 and vice versa. There is no Liveupdate installed on this server and no internet proxy setup . Looking at the Client activity logs - we saw this entry:

System message from LiveUpdate - LiveUpdate Manager - An update for Intrusion Prevention Signatures was successfully installed. The new sequence number is 131126011.

Any ideas why this is happening?