if you are an owner of a popular paysite(s) you need to go to <deganews.com> and put in the name of your site.
this will tell you if asswipes are trading info about how to spoof your members area.
the "tar=ref" spoof is very common, and can be fixed by beefing up your member area security.
if you are on ccbill they can show you how to do it.
also if you are hosting video files you should have <antihotlinking.com> in place and be redirecting your hotlink attempts to some sort of sales page.