OnlyFans Copyright Takedowns Reveal Compromised University and Government Websites

Attackers are increasingly leveraging compromised legitimate websites to manipulate search engine results, a tactic that has been uncovered through an unusual source: copyright takedown requests related to adult content. Research from UpGuard reveals that vulnerable university and government websites are being hijacked to host malicious content and influence search engine rankings, often masked by copyright enforcement actions concerning OnlyFans and similar platforms.

Greg Pollock, UpGuard's director of research and insights, explained that this investigation began with an analysis of search engine spam. Attackers have long exploited websites that can be tampered with to inject their own content, frequently adult material due to its high popularity online. The novel aspect of this discovery came when Pollock observed DMCA (Digital Millennium Copyright Act) notices being filed against legitimate government websites that had been manipulated to display adult content. These sites were inadvertently caught in the same enforcement mechanisms used to police pirated adult material hosted on dedicated porn leak sites.

This tactic involves attackers compromising a legitimate website, such as a university or government portal, and then injecting adult content into its search engine results. When the copyright holders of this adult content, including creators from platforms like OnlyFans, discover their material being pirated and appearing on these compromised sites, they initiate DMCA takedown requests. These requests are typically directed at search engines like Google, which then remove the infringing content from search results. However, the underlying compromise of the legitimate website often goes unnoticed until these takedown notices are investigated.

Pollock highlighted that while not a real-time detection tool, the vast number of DMCA notices filed for adult content provides a valuable historical record for security teams. By analyzing these notices, organizations can identify legitimate websites, including those of their vendors and third-party partners, that may have been compromised and used to distribute unauthorized material. This indirect method can reveal security weaknesses that might otherwise remain hidden.

Universities and government agencies appear to be particularly attractive targets for these attacks. Their websites often have a high domain authority, meaning they rank well in search results, making them ideal platforms for attackers to manipulate search engine rankings. Furthermore, these institutions may have complex IT infrastructures with numerous potential vulnerabilities that attackers can exploit. The compromise of such sites can lead to significant reputational damage, in addition to the risks associated with hosting malicious content.

The implications of these attacks extend beyond mere reputational harm. Compromised websites can be used to host phishing pages, distribute malware, or participate in other malicious activities. The attackers' goal is to exploit the trust and authority associated with legitimate domains to achieve their objectives, making it harder for users and security systems to distinguish between legitimate and malicious content.

To combat this evolving threat, organizations are advised to proactively identify and address vulnerabilities within their web infrastructure. Regular security audits, prompt patching of known vulnerabilities, and robust web application firewalls (WAFs) are crucial. Additionally, monitoring for unusual search engine result placements or DMCA takedown notices related to their domains can serve as an early warning system for potential compromises.

This sophisticated attack vector underscores the interconnectedness of the digital landscape and the creative ways threat actors exploit existing systems and legal frameworks. The use of copyright enforcement as a cover for website compromise highlights the need for continuous vigilance and a multi-layered security approach to protect against emerging threats.