I've foolishly relied on "security through obscurity" for my various AWStats reports. I have also had lots of referrals to my sites from sites which have nary a link on them pointing my way.
Duh.
I was being used by these scumsuckers to provide bogus links THEIR way, thanks to my unsecured aws folders, in which dwelt my traffic reports. Presumably, these "links" would enhance their status with the search engines.
It was fixed with putting password protection in place via .htaccess.
If you have wide-open web tracking reports, and are seeing crap sites as major referrers, you're being used.
Implement password protection ASAP.
