OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard’s Greg Pollock explains what universities, government websites, and security teams need to think about next.
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard’s Greg Pollock explains what universities, government websites, and security teams need to think about next.
A university website gets hacked and, suddenly, its search results are promoting adult content. It sounds like an embarrassing but isolated incident. But according to research from UpGuard, these cases may be part of a much larger and growing problem — one that reveals how attackers exploit vulnerable websites and the digital footprints of legitimate organizations, exposing them to a variety of potential risks including reputational damage.
In an interview with Dark Reading associate editor Kristina Beek, Greg Pollock, UpGuard’s director of research and insights, explains how an investigation into search engine spam led him to an unexpected source of threat intelligence: copyright takedown requests filed by OnlyFans and other adult content creators. These requests, filed by creators and their brand protection services, which track down pirated content, can reveal when legitimate websites have been compromised and manipulated to distribute unauthorized material.
While the data isn’t a real-time detection tool, Pollock says it offers security teams a valuable historical record for investigating potential compromises across vendors and third parties. He also discusses why universities and government agencies are particularly attractive targets, how these attacks can pose risks beyond reputational damage, and what organizations can do to identify vulnerabilities before attackers turn to them next.
For all of our Dark Reading news videos, please check out our YouTube channel, and our curated video articles.
Kristina Beek & Greg Pollock: Full Transcript
This transcript has been edited for clarity and length by Informa TechTarget’s internal AI assistant. For the full experience, please watch the video.
Dark Reading’s Kristina Beek: Hi everyone, my name is Kristina Beek, and I’m an associate editor with Dark Reading. And today I’m joined by Greg Pollock. Greg, thank you so much for joining us today. And you are sharing about some of your research, which is very interesting, because it is a little bit strange in the fact that it is OnlyFans related, but not in the way that people would think. So I would love if you could just introduce yourself and then we’ll get into some of your research.
Greg Pollock: Yeah, thanks, Kristina. Yeah, I’m Greg Pollock. I’m the director of research and insights at UpGuard. Yeah, and I always introduce this research piece by saying it’s about OnlyFans and not about copyright law. Because it is really about copyright law and the DMCA. But that part is not quite as fun-sounding.
DR’s Kristina Beek: I’m sure, I’m sure. So could you maybe just walk us through the key findings of this research and how you began to investigate it or what prompted your interest in this area?
Greg Pollock: Yeah, I’ll start with what got me started on this because that’s really like the easiest way. It can get complicated. And there’s no way to get around it. This starts with SEO porn spam. So this is a problem that’s been around forever. I think security practitioners have probably encountered this in their working lives, where attackers will find websites that can be tampered with in some way and then manipulate them to change the search engine results to have attacker planted content. And it is very, very often, you know, adult content in nature because adult content is incredibly popular on the internet.
So, it starts with, it started with investigating a website where there were some other indicators of compromise. And then in the process of doing so, I hit up Google, I see all this porn spam on that side. Cool, all that’s normal. But at the bottom of the page, the Google page, I saw that some results had been removed due to DMCA notices. That was new to me. And so, starting there, I then found, “Yeah, so this you know legitimate government website — had been reported for DMCA violations because it was advertising or using the names of adult performers.” So that’s that’s really weird, because all of the other sites in the complaint were porn leak sites.
So why was this government site caught up in the same mechanism used to police the DMCA takedowns for these other sites? And that led on to when government sites or other websites, legitimate websites, are tampered with and have adult content injected into their search engine results, then the people who own that content, the you know the adult content creators, they have this brand protection software going out, finding it, reporting it to Google, and all that sort of trickles down into really millions of DMCA notices sent to Google to protect the copyright ownership of adult content creators, and you can look in there and you can find yeah the legitimate websites have been tampered with and unintentionally distributing this content. Does that sorry does that make sense? There’s this multistep process.
DR’s Kristina Beek: Right. So what I’m sort of hearing sort of at the end of this process is that these content creators, these OnlyFans content creators, they’re they see that there is a copyright issue and they go report that to Google. And that’s how you I guess in a way they stop these threat actors from being successful.
Greg Pollock: Yeah, exactly. So, Google publishes the Google Transparency Report, they’re sharing lots of information about how they are, you know, acting on content to enforce laws and so forth. And so they share about 18 billion copyright requests that they’ve received. And most of those are for, you know, regular media piracy. But the number three, like all-time high score for copyright take on requests. Is a one of the big porn brands. So it’s a huge problem having adult content pirated and then it yeah shows up in in Google’s copyright stuff. Now one of the things that’s interesting is that in recent years then the adult industry has kind of changed from Pornhub and these really like horizontally integrated studios to literally millions of individual content creators. And all of them, you know, they are doing this as their job. They need to be paid their work and so all of them are searching for people who are pirating their content and then, yeah, and then so they have specialized tools that are searching the internet if I’m putting out my content. I’m not something looking for Greg Pollock’s content and then if i find it on a website my brand protection will report it and, yeah, and then it trickles down into these DMCA requests that we can read because of, you know, Google provides them to us.
DR’s Kristina Beek: That’s so interesting. These content creators are very locked into where their content is or where it’s being reported or copyrighted. So, in a way, they are functioning as like a threat detection mechanism. How valuable would you say is this type of signal to like a regular like security team?
Greg Pollock: Yeah, it’s interesting. So there, the content creators brand protection software is, you know, sort of scouring in the internet in real time for their names and likenesses to get it taken down and sort of, you know, prevent losses from having their content taken. And so by the time we get it from Google, you know, it’s this is not a fast means of finding it. So there’s the brand protection software finds it, they report it, Google has their process, it goes through that process, and then finally it gets shared in the transparency report. So this is not like a fast way to monitor your website. What it is, is it’s a really good in terms of breadth. So if you have lots of vendors and you want a way to see, hey, have they maybe been compromised. I can use this as a way to look across a historical archive of all of my vendors or third parties I interact with. And it’s a really good breadth detection. And then the other part is that it’s an archive that lasts forever. So another problem is that a website’s compromised, someone fixes it, and then Google flushes that from the cache. It’s very hard to find out what has happened in the past without being the one monitoring it at that time. Well, this is awesome. This is like an archive going back to 2011. So you want to find out across a huge collection of companies, or you’re starting to do business with the company and you want a nice archival record, we can go and yet see have they ever shown up in this. So yeah, I think the important distinction for security practitioners is like this is not a way to monitor your website for compromise. There are much better ways to do that and much faster ways to do that. But it offers something that it is actually really hard to do on your own. It’s really hard to monitor in lots of companies, and it’s really hard to get huge archival data sets. So that’s where that’s where it becomes useful.
DR’s Kristina Beek: So, would you say that government and university, you know, very official sort of websites are targeted in particular in these sorts of situations?
Greg Pollock: Yeah, they have two properties that make them show up more here. I will say I use them as my examples in part because they show up often, but also because they are really easy to like discern based on their top level domain. So like .edu’s, it’s pr,etty easy to classify government and education websites. But the two things that make them attractive targets are one, they’re really valuable. They’re valuable because Google considers these high domain, high authority domains. And so, Google will prioritize them in search results.
So, if my little website that nobody goes to gets compromised, it’s never gonna show up in the search results. But if you can get a foothold on a .edu, a .gov, the Google, you know, trusts those and puts them high in the rankings. So from an attacker’s perspective really good targets for search engine tampering. The second thing is they’re not just valuable, but they’re also vulnerable. These are institutions that tend to have really big footprints. Be very budget constrained, stuff gets stood up, it hangs around forever. Universities have a really hard challenge because they have so many consumers of their digital footprint. You want to have student clubs on there, you want to have all your CS students doing stuff. You have your professors doing their research projects. They have a massive footprint so that it becomes just the kind of factors that make it unlikely for something to get forgotten about, unmaintained, and then ultimately you know be able to be compromised one way or another.
DR’s Kristina Beek: What advice would you give to university, people running those websites or their security because of this underlying issue of their sort of lack security or their digital footprint? What advice would you give to them to sort of solve this issue? Because I mean that is kind of crazy that, like these, I mean, whatever your opinion is that these porn-related content is on their website. Like, you know, it maybe doesn’t give the best impression. And it’s also accidental because it’s not their fault. Like these are threat actors that are doing this. What would you say to them?
Greg Pollock: Right. To first I’d say yeah, the harms are as you alluded to. They can range from just kind of brand reputation, which are pretty minor, right? Like if your website says, you know, check out, you know, Greg’s showing feet, like that’s it may be embarrassing, but it’s not like it’s not damaging in the way that it could be a loss of, you know, PII and so forth.
But there is a spectrum of causes for those search engine results showing up. And they can range from really trivial causes that are, you know, just embarrassing, over to, well, the threat actor being able to write content to this site — they could be putting up malicious JavaScript, they could be doing much more dangerous things that either allow exfiltration of data or compromise of users. And so the symptom that we have here, you need to sort of play out why is that happening to understand what the real harm of it is. But as far as your real question, what’s my message to the defenders?
Part of, I mean, the things I’m saying here are things that I think security practitioners know because it’s really kind of, I don’t want to say basic, but these are Web security fundamentals of updating your CMS, you know, checking for cross-site scripting, all these kinds of not having open redirects. These are pretty well-known Web security issues. The problem is having the time and resources to be able to not just enforce them across new sites, but as I was saying for the case of universities and governments, monitor your whole back catalog of all the stuff that somebody has wanted to send up at one time or another. And so part of what I’ve tried to do with the attention this has gotten is, it’s not that your security team needs to be doing something different that they don’t know about. It’s that the the administrators or the people who provide budget to those teams need to be aware that, yeah, this is there are ongoing attacks. There is an active threat environment and those teams need more.
DR’s Kristina Beek: Absolutely. Was there something in particular that was really surprising or alarming about your discovery?
Greg Pollock: The thing that I found most surprising was how recently this trend has taken off and how much it is accelerating. So in terms of the recency, when I started using this, you know, this series of pivots to find websites I’ve been tampered with, going from DMCA takedown requests sent from adult content creators and then looking in those requests for government websites. Then the volume of requests from those content creators really goes from zero to millions in 2024 and 2025. And that’s that happens because, you know, we have sort of the takeoff of OnlyFans and then there are other platforms like it, but OnlyFans is the main one. That, you know, 2020 is kind of when that starts growing really, really fast. And so then it’s a few years later when there are so many content creators with and there’s so much money being exchanged that you get these specialized brand protection platforms and they get really, really good at this existing. And so it’s really only in the last couple years that you could have done what I did here, which is use these requests to find these websites. And at the same time, even when we you know kind of boil it down and kind of remove that cognitive bias or that confirmation bias, then the number of unique domains is growing dramatically. So to me, the biggest surprise was yeah, this is a problem that’s It’s not like a steady-state problem that I happen to observe through a weird way. It’s a growing problem. And so if you if you don’t attend to this, then there’s an increasing likelihood that especially your university website will be defaced in this way.
DR’s Kristina Beek: Right, absolutely. I know we’ve talked about the advice that you would give to universities, maybe not necessarily their security teams, but their board members of how we’re funding these situations. What advice would you give in terms of this research, you know, for the security professionals who are reading it, what is like the one takeaway you want them to have from coming into this research?
Greg Pollock: Yeah, one thing is there are things you can do to check your own search engine results. And I think, especially with AI and some of the AI tools, then these are you could set up like a very trivial just daily check on Google my website for a few adult keywords and that would be effective to flag whether this has happened. And I think it’s worth doing because the systems that are doing the website tampering that are injecting these results are so automated and so horizontally scaled that they are crawling the internet and just blasting us wherever they can. And that’s why it happens both in cases where the tampering is really trivial and not a problem, because it’s just gonna do it and then maybe the effects are trivial and embarrassing but maybe those same effects hit a website that’s more vulnerable and that’s where they are, you know, getting their value out of it. So they’re spraying and praying, and it makes it very likely that a website with any kind of susceptibility to this will be hit. So yeah, I think having some kind of search engine results monitoring is a pretty cheap, pretty effective way to have an early warning there.
DR’s Kristina Beek: Absolutely. So this comes to the end of our interview, but I know that you’re working on a lot of different things. Is there anything in particular that you’d like to mention that you’re currently working on or that you could share with us?
Greg Pollock: Yeah, mean, so one of the other recent projects was about shadow AI and misconfigured databases and AI applications. And this was building on prior research done by other people over the last really two years. I think it was early 2025 when a researcher discovered that apps created in Lovable will often have Supabase as the database backing it and would often have those configured without correct security configurations making the databases publicly readable. And over the last couple of years, people have figured out other ways in which those databases can be misconfigured. Well, we recently did a big survey of Supabase databases because it is really like the favor database by vibe code and these other coding agents. And it’s a to be honest, I’ve used Supabase. It is super convenient, it’s great product. But the people using it often don’t understand how to configure databases. They are vibe coders who probably never even look at the code that’s being shipped. So yeah, we’ve done some research recently on that as a problem really coming out of vibe coding and the problem of, you know, not looking at your database. You should look at your database.
DR’s Kristina Beek: Right, yeah. And where can viewers, readers find your work or your research online?
Greg Pollock: We’ll be launching a cool new thing very soon. Right now, you know, UpGuard.com, UpGuard.com/breaches is our blog we launched almost 10 years ago when we started doing data leak research. But yeah, we will be having an announcement in about a month and a half of a new research blog with even better stuff.
DR’s Kristina Beek: Amazing. So cool. Well, thank you so much for taking the time to speak with me. This was a really interesting topic to hear about. So thank you.
Greg Pollock: Hey yeah, Kristina, thank you. It was awesome.
Read more about:
