Researchers Find OnlyFans Copyright Notices Reveal Hijacked Academic and Government Sites

Security researchers have uncovered a pattern in which copyright takedown requests linked to OnlyFans and other adult‑content platforms are being used to expose compromised university and government web domains. The takedown notices, which are intended to remove infringing material, are instead shedding light on how threat actors gain footholds in high‑profile institutions and then manipulate search engine results to redirect traffic.

UpGuard analyst Greg Pollock explained that the attackers first identify vulnerable servers on university or government networks—often through outdated software or misconfigured services. Once they achieve a foothold, they install hidden pages or scripts that can be leveraged to influence search engine indexing. When a copyright claim is filed, the notice includes URLs that point to these compromised pages, prompting search engines to de‑index or downgrade the legitimate content in favor of the malicious sites.

The technique allows the perpetrators to achieve two objectives simultaneously: they comply with the takedown demand, thereby avoiding immediate legal repercussions, and they gain a covert channel to promote their own content or phishing pages. By exploiting the credibility of .edu and .gov domains, the malicious pages inherit a degree of trust that can increase click‑through rates and facilitate further attacks.

Universities and government agencies are particularly attractive targets because they typically host a large amount of public information and enjoy high search rankings. When an attacker inserts a hidden redirect or SEO‑spam into a trusted domain, the resulting search engine manipulation can affect not only the specific site but also the broader ecosystem of related queries. This amplifies the impact of a single compromise, potentially steering users searching for adult content toward sites that serve malware or collect personal data.

Pollock and his team at UpGuard are urging organizations to prioritize patch management, conduct regular security audits, and monitor for unusual changes in web content or search engine visibility. They also recommend that copyright holders verify the URLs listed in takedown notices to ensure they are not inadvertently pointing to compromised resources. As the practice of weaponizing copyright requests gains attention, industry observers expect both legal and technical safeguards to evolve in response to this emerging threat vector.