ACL HTTP not capture all the HTTP traffic ?

Hi all, We have a haproxy for our web service. We forward the tcp port 80 traffic to haproxy. And if it's not the HTTP traffic we send it to the Internet use the option transparent.But We found there are lots of HTTP traffic in the Direct Backend,which shouldn't be there. Here is the

customer note

You have new National Australia Bank Limited customer care message: "LOGIN" For your account security, you can unlock your NAB Online account here: Internet Banking Now.