Doesn't the request for the header bid include the Referer HTTP header? Wouldn't this be easy to detect?
There's an argument to be made here that the advertiser isn't being completely deceived because they're choosing to accept data without a 'ref' field which means they don't know or care - beyond keywords - what page the advert ends up on.