I recently got a direct ad campaign for one of my sites. The advertiser agreed to my price without much bargaining. No contract was signed, but I had specified pre payment as part of our agreement. The advertiser is not a major network. Currently they are showing affiliate ads.

Some things about this deal seems fishy to me - The amount was direct deposited to our account, not transferred from their company account. - Just below the visible ad, I can see a hidden iframe which contains the flight search widget for a major airline (Could this be cookie stuffing?) - They are contacting me from a gmail account - They did not insist for a signed contact

How can I ensure that the advertiser is legitimate and is not using the adslot for illegal purpose?