This is more or less the most useless reply possible.
No, it is not competitors advertising. Ads on Google Search are clearly indicated and there are none for the search terms tested.
No, the server is not under his desk (???). The server is a standard dedicated server hosted with a well-known provider. I checked it in terms of configuration (DNS, HTTPS), not with a voltmeter or whatever you have in mind.
No, dynamic content and SEO are not going to help when the site does not show up at all. Those are tools for improving ranking, not getting the site to show up whatsoever.
Let me put the question more simply: Assuming fraudulent RtbF requests are possible, how can they be identified and challenged?