Ah the old slow hack method.
I remember back in the earlier days of TF2 one guy used to do this with quick play. Back then if you connected via quick play you could only be shown the connection HTML page one time. This was to cut back on people spamming ads. So they guy setup a server with like 14 faked clients to get high quick play server rank. This high rank would cause Valve to drop people into his server more often. When they connected it would then slow hack them redirecting them to one of his other non-quickplay servers and forcing their HTML CVAR on.
As shady and messed up as it is honestly I would be scared to report such things to Valve. Knowing them they would either do nothing or take some heavy handed option.
The only solution I can think of would be to force servers to use sv_setsteamaccount like they did in CS:GO. And your server wont show up on the master list unless you tie it to a Steam account in this way. Then they can ban bad actors Steam accounts. Though I guess even with that people found a way around it by auto generating accounts and Valve gave up lol.
Or I guess if they can figure out a way to prevent this redirection method. (I believe it was reported here:
https://github.com/ValveSoftware/halflife/issues/1497 and of course nothign was ever done to fix it.)
EDIT: Also, doing this must cost him a lot of money though right? I mean if he is putting up 100s of fake servers those servers still take resources. I can't imagine in this day and age he is making enough to cover the costs. Probably once they realize it isn't as profitable as they thought they might stop.
__________________