cat, nice service!
We own quite a few TGPs and constantly monitor cheater activities. The source of all evil is (surprise!) a bunch of Russian crooks. They run bannerless freehosts and steal alot of our traffic. Some advanced cloaking is used to hide redirects from bots and reviewers but we easily detect them anyway.
Luckily they discuss technical details on their forum. Maybe they are dumb to think nobody can read Russian.
Here they are talkin about changing nameservers:
http://www.crutop.nu/ubb/Forum6/HTML/003035.html