The web shield monitors and redirects http traffic and that doesn't just have to be when you are browsing. Some programs connect to the internet using http and don't so it using your browser.
Do you know what this mpnd is ?
All I can find is it appears to be a possibility is mpnd = Microsoft Developer Network Platforms, ring any bells.
Though this IP also belongs to an IP block reserved for future projects, in the afrinic.net domain registration area, weird.