after browsing to the tickets, I found the following one:
http://www.isp-control.net/ispcp/changeset/888
It's the changeset of today, but if you check the changes for the awstats file, you'll notice that it differs from the ticket above.
changes:
http://www.isp-control.net/ispcp/changes...nf&new=888
Before : HostAliases="www.{DOMAIN_NAME} REGEX[^.*\\{DOMAIN_NAME}$]"
Ticket : HostAliases="www.{DOMAIN_NAME} REGEX[^.*\.{DOMAIN_NAME}$]"
Patchset : HostAliases="www.{DOMAIN_NAME} REGEX[^.*\{DOMAIN_NAME}$]"
Where the before & patchset regex give the same results, and the ticket regex returns even less bandwidth...
I also checked the traffic files and the combined files on traffic sizes. They both report the same values, so I think the "masterdata" for both tools (ispcp & awstats) are correct, but that the error lies in the processing of one/both tool(s).