I noticed that in one of my server's /var/log/ufw.log this morning that the firewall had blocked the IP address 91.189.91.23 from accessing port 80. This occurred 9 times within about a minute and a half, around 6:34, which interestingly is when logrotate goes about its daily business (not sure if that's relevant).
A reverse DNS lookup listed that IP as economy.canonical.com.
I don't expect my external router to let any traffic in on port 80, and would be concerned about an intrusion in my network. Is this something internal or a cause for concern?
