Shlapik?!

Any clue about Shlapik?

[Marino]

Hello,

I've found this curious referer in my logs :

81.176.9.#*$! - - [17/Feb/2005:08:46:59 +0100] "GET /webstat/usage_200502.html HTTP/1.0" 200 125152 "e:/net/contact_with_shlapik/webalizer_new.htm" "Mozilla/5.0 (compatible; MSIE 5.0)" 26

I first thought it was just some mistake, like these ones :

dominator.ikr.#*$! - - [01/Feb/2005:03:00:46 -0500] "GET /mime/jpg/Will_code_HTML_for_food.jpg HTTP/1.0" 302 296 "file://F:\\RulezzzSoft\\!Soft_Craking\\Docs\\forum\\f\\index.php-action=vthread&forum=2&topic=799.htm" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)" 0
219.136.168.xxx - - [11/May/2005:09:36:34 +0200] "GET /mime/markup/php/accessibility_en/other_alternates_en/other_alternates_11.php HTTP/1.0" 200 32086 "f:/new keys/adverts/the lynx advert.htm" "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT 4.0)" 12
a80-126-115-xxx.adsl.xs4all.nl - - [28/Jan/2005:02:34:14 -0500] "GET /mime/markup/php/home_en/home.php HTTP/1.1" 200 21156 "http://intranet/getlinks.php?cat=39&tree=internet" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041217" 1

...but looking for it in Gppgle, I found it was present in many webstats reports, and typing in "contact shlapik", it seems that "shlapik" is a russian porn word.

So who/what is Shlapik?

[Dijkgraaf]

Looks like Shlapik is trying to create referer log spam to sex sites. However in this instance, rather than given the URL of a web page that he had published on the intenet he made a mistake and used the path of the file on his own machine.
If had got it right, it would have been the URL of a page which would probably then have forwarded you on to another web site with the querystring "?id=shlapik". Doing a search for shlapik on Google will get you various links to dubious sites with ending with that query string.

The fact that your stats are visible makes you a tempting target for referer log spam. Get your webstat directory password protected.