So I did try digging into this again a bit more. According to the community, TLS was not in use, and nor was SFTP. (There's some suggestions that it was the IIS

So I did try digging into this again a bit more. According to the community, TLS was not in use, and nor was SFTP. (There's some suggestions that it was the IIS FTP server, but I can't confirm it.) As to logging, most FTP servers log the forwarded IP and not the connecting IP when you enable forwarding. So yes, FTP may well be the point of entry. (Worth noting that a couple minutes looking at the palemoon site still comes up with quite a few security red flags. Like unenforced SSL on download pages, archive.palemoon.org still has no SSL, etc.)