1

Why is this url: http://www.zescience.com, that has nothing to do with my website or Wordpress blog in my RawLogs dump?

#Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken

2014-08-03 22:25:15 LITTLENOMADS HEAD /blog/wp-login.php X-ARR-LOG-ID=274e7a78-851c-4103-a27a-9a68b91a5560 80 - 159.253.147.4 WordPress/3.9.1;+http://www.zescience.com - - littlenomads.azurewebsites.net 200 0 0 515 633 328
1
  • There should be a line somewhere near the top of the logfile, or the last server/instance startup that reads something like #Fields: date time c-ip cs-username s-ip... Could you please post what that line looks like in your case?
    – nanofarad
    Aug 4, 2014 at 0:09

2 Answers 2

1

The field in your logs that you are seeing is the cs(User-Agent) one, and the actual value in this field is all of WordPress/3.9.1;+http://www.zescience.com

Something (probably a bot or WordPress plugin) is requesting your URL using that User Agent.

1

Your data is in the W3 log format. The log will include a header similar to

#Fields: date time c-ip cs-username s-ip...

that describes the fields that are included in each log entry. The tenth field in this header should describe the type of field that the URL in question is. I would guess that the field is the referer, or a site that had a link to your site, that the client followed.

If you post the Fields header line specifically I can tell you exactly what it is.

2
  • Hi, I added the headers, there is no referer, I am typing the url /blog/wp-login.php in the browser...
    – Brian
    Aug 4, 2014 at 1:15
  • @Brian No, that is the referer (cs(referer) is listed in headers). I would check zescience to see if there is a link to your site, possibly in a comment.
    – nanofarad
    Aug 4, 2014 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .