1

Why is this url: http://www.zescience.com, that has nothing to do with my website or Wordpress blog in my RawLogs dump?

#Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken

2014-08-03 22:25:15 LITTLENOMADS HEAD /blog/wp-login.php X-ARR-LOG-ID=274e7a78-851c-4103-a27a-9a68b91a5560 80 - 159.253.147.4 WordPress/3.9.1;+http://www.zescience.com - - littlenomads.azurewebsites.net 200 0 0 515 633 328
Brian
  • 321
  • 3
  • 5
  • 15
  • There should be a line somewhere near the top of the logfile, or the last server/instance startup that reads something like `#Fields: date time c-ip cs-username s-ip...` Could you please post what that line looks like in your case? – nanofarad Aug 04 '14 at 00:09

2 Answers2

1

Your data is in the W3 log format. The log will include a header similar to

#Fields: date time c-ip cs-username s-ip...

that describes the fields that are included in each log entry. The tenth field in this header should describe the type of field that the URL in question is. I would guess that the field is the referer, or a site that had a link to your site, that the client followed.

If you post the Fields header line specifically I can tell you exactly what it is.

nanofarad
  • 179
  • 3
  • 13
  • Hi, I added the headers, there is no referer, I am typing the url /blog/wp-login.php in the browser... – Brian Aug 04 '14 at 01:15
  • @Brian No, that is the referer (`cs(referer)` is listed in headers). I would check zescience to see if there is a link to your site, possibly in a comment. – nanofarad Aug 04 '14 at 11:12
1

The field in your logs that you are seeing is the cs(User-Agent) one, and the actual value in this field is all of WordPress/3.9.1;+http://www.zescience.com

Something (probably a bot or WordPress plugin) is requesting your URL using that User Agent.

Peter
  • 126
  • 7