OnlyFans creators file takedown notices to protect their income. It turns out those notices are also showing where hackers have broken into government and university websites. Each “leaked OnlyFans” page a creator reports to Google leaves a public record, and some of those records point straight at hijacked .gov and .edu domains.

According to Dark Reading‘s Kristina Beek, in an interview with UpGuard director of research and insights Greg Pollock published October 19, copyright takedown requests tied to OnlyFans and other adult creators show how attackers use vulnerable official websites to game search results. The research first surfaced in July, when WIRED‘s Matt Burgess reported that more than 2,000 government and education domains across 80 countries had gotten takedown requests linked to adult creators over the past 15 years.

How a porn-spam hunt turned into threat intel

Pollock told Dark Reading that the project started with SEO porn spam, an old trick where attackers tamper with a website so search engines show content the attackers planted there. While looking into a site that already showed other signs of compromise, he spotted a note at the bottom of Google’s results saying some links had been removed because of DMCA notices. The complaint listed porn leak sites, plus a legitimate government website flagged for using adult performers’ names.

Pulling on that thread, he found the pattern behind it. Creators’ brand-protection software scans the web for pirated content and reports it to Google, which publishes the notices in its Transparency Report. Pollock told Dark Reading that Google has disclosed about 18 billion copyright requests, and the volume from adult creators went “from zero to millions” in 2024 and 2025 as OnlyFans took off.

The numbers behind the hijackings

WIRED’s Burgess reports that Pollock’s analysis found 384,286 takedown requests covering 631,193 URLs, sent from adult creators against government and education sites since 2011. Google appears to have removed about 130,000 of those URLs and taken no action on around 460,000. The hijacked pages carried titles like “biggest leak yet” next to the names of creators with millions of followers, but often redirected visitors to online-dating and other suspicious pages.

Pollock’s analysis says one Estonia-based company, Rulta, was behind about 90 percent of the requests in the past couple of years. Overall, it counted 11,000 adult-content copyright owners, represented by 554 organizations. Creator Laura Lux, who uses Rulta, told WIRED her name has shown up on domains in Vietnam, South Africa, Bangladesh, Somalia, and Brazil. Her take on creators accidentally flagging breaches: “I guess sex workers save the world again.”

Why .gov and .edu sites get hit

In an interview with Federal News Network‘s Eric White, Pollock called the tactic “parasite SEO.” Google treats government and university domains as highly trusted and ranks them high, which makes them prime real estate for scammers. He told Dark Reading these sites are also vulnerable. They tend to be huge and short on budget, full of old club, student, and research pages nobody maintains.

The harm can range from embarrassing to dangerous. Pollock explained that if attackers can write content to a site, they may also be able to plant malicious JavaScript or steal data. He was careful to say the takedown data isn’t a real-time alarm. It’s a historical archive going back to 2011, useful for checking vendors and third parties. For a fast early warning, he suggested a simple daily Google search of your own site for a few adult keywords.

Not everyone loves the DMCA approach

Some people who work on content removal question the method. Dan Purcell, founder and CEO of takedown firm Ceartas, told WIRED that sending DMCA notices to hacked official sites is excessive and probably not a copyright violation, since those sites aren’t hosting the content on purpose. His company contacts the site’s security team instead. Alexander Small, cofounder of Fanlock, said his company only files when a page actually hosts a client’s work, not when it just uses a creator’s name as bait.

The takeaway

Piracy is a big enough problem that Lux told WIRED creators “might as well probably not even be bothering” without a DMCA service. That same effort now gives security teams an unexpected map of hacked websites. For creators, it’s a reminder that scammers use your name as bait well beyond leak sites, so pick takedown partners who know the difference between stolen content and a hacked page.

Image: Lines of code on a laptop screen, photo by Artem Sapegin (CC0 1.0), via Wikimedia Commons.