As per default phpBB configuration for Apache/Nginx (f.e. .htaccess), all non-existent URLs will be handled via app.php and saved to the session_page column in the session table. F.e. example.board/non-existant.jpg will be written down to the database as app.php/non-existant.jpg session_page. Then viewonline.php will recognize it as "Index page" user location.

To solve this, any HTTP404 pages should never be saved to the session_page column.