I see a drop on port 80 but a listen on 443.
Otherwise do a traceroute to 119 to find out by which route its coming in.
Otherwise do a traceroute to 119 to find out by which route its coming in.