Originally Posted by helenp
What I dont understand is the referer index.php as this does not exists, also there are no link on the web as far as I know to any index.php page.
Ah, I understand.
If you take a look at the request and responses to your service with something like the Firefox add-in HTTP Live Headers, you'll see the 404 and other bits and pieces going on. Initially I thought I had a browser helper doing an auto search and correcting the request when the 404 came back, but when I could get Lynx to do it to, I figured you must have a custom 404 handler on that server that is issuing a meta-refresh to index.htm
If you trace the request in Lynx you get:
[command: lynx -trace -tlog http://www.marbellasunrentals.com/index.php]
GET /index.php HTTP/1.0\r
Accept: text/html, text/plain, text/css, text/sgml, */*;q=0.01\r
Accept-Encoding: gzip, compress, bzip2\r
User-Agent: Lynx/2.8.8dev.2 libwww-FM/2.14 SSL-MM/1.4.1\r
Sending HTTP request.
HTTP: WRITE delivered OK
HTTP request sent; waiting for response.
HTTP: Trying to read 1535
HTTP: Read 1420
HTTP: Rx: HTTP/1.1 404 Not Found
HTTP: Scanned 2 fields from line_buffer
--- Talking HTTP1.
Alert!: HTTP/1.1 404 Not Found
The 404 error page contains this line:
<meta http-equiv="Refresh" content="5; URL=index.htm">
Which bounces any page not found (404) to index.htm. Naturally this will catch a request for index.php
This will mean your logs correctly show both file not found (for index.php error code 404), and preserves the original requested URI (index.php) passing it through as the referrer - which I guess you could argue it kinda technically is.
Something much cruder that just shows the 404 error, without redirecting:
--2012-01-20 11:40:52-- http://www.marbellasunrentals.com/index.php
Resolving www.marbellasunrentals.com... 22.214.171.124
Connecting to www.marbellasunrentals.com|126.96.36.199|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2012-01-20 11:40:52 ERROR 404: Not Found.
Hope that sounds plausible - take a look at your 404 handler page, it's not the vanilla Apache offering and is customised with that meta refresh by the look of it :-) A request for index.jsp, index.asp or index.any_old_thing_that_does_not_exists will do the same thing :-)