Amber, since battling with these bastards in my
looong blacklist I discovered another scam which seems to be almost impossible to catch: about every 5th hit to the galleries goes to a dialer-/pop-up/startup changing hell, and it looks like it's a script or htaccess thing at the host (nameserver: YCISP.COM). All you can do is 'whois' lookup before you list any new/unknown url (I know - it takes aaages!).
I did a longer trial yesterday with a mate in Holland (doubledrilled) who's running Brownie, and we couldn't figure it out...