g1smd - 11:35 pm on May 22, 2012 (gmt 0)

You can always install a logging script and you'll soon discern where the requests are coming from:

Set $statusCode to a three digit number before calling the include file when calling it from your error document pages.

<?php

# Error Event Logging 2012-05-24 (logger.php)

$oldSetting= ignore_user_abort( TRUE );// otherwise can screw-up logfile

if( !empty( $GLOBALS[ '_SERVER' ])) {
$_SERVER_ARRAY= '_SERVER';
} elseif( !empty( $GLOBALS[ 'HTTP_SERVER_VARS' ])) {
$_SERVER_ARRAY= 'HTTP_SERVER_VARS';
} else {
$_SERVER_ARRAY= 'GLOBALS';
}

$requestHost= ${$_SERVER_ARRAY}[ 'SERVER_NAME' ];

if(stristr($requestHost, 'example.co.uk')) {
if(stristr($requestHost, 'dev')) {
define( '_DIRECTORY', '/var/www/vhosts/example.co.uk/subdomains/dev/httpdocs/includes/logfiles/' );
$site = 'dev';
} else if(stristr($requestHost, 'www')) {
define( '_DIRECTORY', '/var/www/vhosts/example.co.uk/httpdocs/includes/logfiles/' );
$site = 'www';
} else if(!stristr($requestHost, 'dev') && !stristr($requestHost, 'www')) {
define( '_DIRECTORY', '/var/www/vhosts/example.co.uk/httpdocs/includes/logfiles/' );
$site = 'www';
}
}


define( '_LOGFILE','errorlog' . date('-Y-m-') . $site . '-' . $statusCode . '.txt' );
#define( '_LOGFILE','errorlog' . date('-Y-m-') . $site . '.txt' ); // all in one
define( '_LOGMAXLINES','3000' );

global ${$_SERVER_ARRAY};


$logFile= _DIRECTORY . _LOGFILE;

$datetime= date( 'Y-m-d H:i:s O' );

$remoteIP= ${$_SERVER_ARRAY}[ 'REMOTE_ADDR' ];

$requestURI= ${$_SERVER_ARRAY}[ 'REQUEST_URI' ];

$referer= ( isset( ${$_SERVER_ARRAY}[ 'HTTP_REFERER' ]))
? ${$_SERVER_ARRAY}[ 'HTTP_REFERER' ]
: '<unknown referer>';

$userAgent= ( isset( ${$_SERVER_ARRAY}[ 'HTTP_USER_AGENT' ]))
? ${$_SERVER_ARRAY}[ 'HTTP_USER_AGENT' ]
: '<unknown user agent>';

if(preg_match('#(Opera\ [0-9]+\.[0-9]+)#',trim($userAgent), $extracted)) {
$agent = $extracted[1];
} elseif(preg_match('#^(Opera[^(\ ]+)#',trim($userAgent), $extracted)) {
$agent = $extracted[1];
} elseif(preg_match('#^(Xenu.*)#',trim($userAgent), $extracted)) {
$agent = $extracted[1];
} elseif(preg_match('#compatible;\ ([^;]+)#',$userAgent, $extracted)) {
$agent = $extracted[1];
} elseif(preg_match('#^([^\ ]+\ )+([^\(\)]+)#',trim($userAgent), $extracted)) {
$agent = $extracted[2];
} else {
$agent = '<see notes>';
}

$remoteIP= str_pad($remoteIP, 15);

$agent= str_pad($agent, 22);

$requestHost= str_pad($requestHost, 26, " ", STR_PAD_LEFT);

$requestURI= str_pad($requestURI, 80);

$referer= str_pad($referer, 110);

$userAgent= str_pad($userAgent, 120);

$logLine= $datetime . " - " . $remoteIP . " - " . $agent . " - ". $statusCode . " - ". $requestHost . " - ". $requestURI . " - ". $referer . " - ". $userAgent . "\n";

$log= file( $logFile );// flock() disabled in some kernels (eg 2.4)

if( $fp = fopen( $logFile, 'a' )) {// tiny danger of 2 threads interfering; live with it
if( count( $log ) >= _LOGMAXLINES ) {// otherwise grows like Topsy
fclose( $fp );// fopen,fclose put close together as possible
while( count( $log ) >= _LOGMAXLINES ) array_shift( $log );
array_push( $log, $logLine );
$logLine= implode( '', $log );
$fp= fopen( $logFile, 'w' );
}
fputs( $fp, $logLine );
fclose( $fp );
}
exit();

ignore_user_abort( $oldSetting );

?>