I went to go look at the access log as well and found a weird request for /null during this ticket posting.
normal">
mso-fareast-font-family:"Times New Roman";color">1.2.3.4 - -
"POST /open.php HTTP/1.1" 302 4172
"https://domain.com/open.php" "Mozilla/5.0 (Windows NT 10.0;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110
Safari/537.36 Edge/16.16299"
font-family:"Lucida Sans Unicode","sans-serif";mso-fareast-font-family:"Times New Roman";
color">
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"GET /tickets.php?id=162 HTTP/1.1" 200
3745 "https://domain.com/open.php" "Mozilla/5.0 (Windows NT
10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110
Safari/537.36 Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"GET /favicon.ico HTTP/1.1" 404 47
"-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - - "POST /ajax.php/form/upload/attach HTTP/1.1" 200 42
"https://domain.com/tickets.php?id=162" "Mozilla/5.0 (Windows NT
10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110
Safari/537.36 Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"POST /null HTTP/1.1" 404 47
"https://domain.com/tickets.php?id=162" "Mozilla/5.0 (Windows NT
10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110
Safari/537.36 Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"POST /ajax.php/form/upload/attach
HTTP/1.1" 200 42 "https://domain.com/tickets.php?id=162"
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"POST /tickets.php?id=162 HTTP/1.1" 200
4069 "https://domain.com/tickets.php?id=162" "Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"GET /favicon.ico HTTP/1.1" 404 47
"-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"GET /favicon.ico HTTP/1.1" 404 47
"-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"POST /tickets.php?id=162 HTTP/1.1" 200
4335 "https://domain.com/tickets.php?id=162" "Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"GET /favicon.ico HTTP/1.1" 404 47
"-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Edge/16.16299"
normal">
mso-fareast-font-family:"Times New Roman";color"> 1.2.3.4 - -
"GET /favicon.ico HTTP/1.1" 404 47
"-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Edge/16.16299"