Server's IP in URLs in cached templates
These are probably coming from the incoming request in the $_SERVER PHP superglobal

Yii2 does its best to figure out the incoming request, but that's relying on information coming from the client, which is insecure. Note the warning about potential cache poisoning in the Craft CMS docs:


  Don’t ever use the @web alias when defining your sites’ Base URLs. It could introduce a cache poisoning vulnerability, and Craft won’t be able to reliably determine which site is being requested.


This is for the same reason; if no explicit siteUrl is provided, it'll try to figure it out from the request.

In your case, craft.rebrand.getLogo().url ends up calling getImageVariable which then ends up calling the Yii2 asset manager to get the published URL. I think your siteUrl or other aliases may not be set properly.

    /**
     * Returns the schema and host part of the current request URL.
     *
     * The returned URL does not have an ending slash.
     *
     * By default this value is based on the user request information. This method will
     * return the value of `$_SERVER['HTTP_HOST']` if it is available or `$_SERVER['SERVER_NAME']` if not.
     * You may want to check out the [PHP documentation](https://secure.php.net/manual/en/reserved.variables.server.php)
     * for more information on these variables.
     *
     * You may explicitly specify it by setting the [[setHostInfo()|hostInfo]] property.
     *
     * &gt; Warning: Dependent on the server configuration this information may not be
     * &gt; reliable and [may be faked by the user sending the HTTP request](https://www.acunetix.com/vulnerabilities/web/host-header-attack).
     * &gt; If the webserver is configured to serve the same site independent of the value of
     * &gt; the `Host` header, this value is not reliable. In such situations you should either
     * &gt; fix your webserver configuration or explicitly set the value by setting the [[setHostInfo()|hostInfo]] property.
     * &gt; If you don't have access to the server configuration, you can setup [[\yii\filters\HostControl]] filter at
     * &gt; application level in order to protect against such kind of attack.
     *
     * @property string|null schema and hostname part (with port number if needed) of the request URL
     * (e.g. `http://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.
     * See [[getHostInfo()]] for security related notes on this property.
     * @return string|null schema and hostname part (with port number if needed) of the request URL
     * (e.g. `http://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.
     * @see setHostInfo()
     */
    public function getHostInfo()
    {
        if ($this-&gt;_hostInfo === null) {
            $secure = $this-&gt;getIsSecureConnection();
            $http = $secure ? 'https' : 'http';

            if ($this-&gt;headers-&gt;has('X-Forwarded-Host')) {
                $this-&gt;_hostInfo = $http . '://' . trim(explode(',', $this-&gt;headers-&gt;get('X-Forwarded-Host'))[0]);
            } elseif ($this-&gt;headers-&gt;has('Host')) {
                $this-&gt;_hostInfo = $http . '://' . $this-&gt;headers-&gt;get('Host');
            } elseif (isset($_SERVER['SERVER_NAME'])) {
                $this-&gt;_hostInfo = $http . '://' . $_SERVER['SERVER_NAME'];
                $port = $secure ? $this-&gt;getSecurePort() : $this-&gt;getPort();
                if (($port !== 80 &amp;&amp; !$secure) || ($port !== 443 &amp;&amp; $secure)) {
                    $this-&gt;_hostInfo .= ':' . $port;
                }
            }
        }

        return $this-&gt;_hostInfo;
    }