Eric White So with an emphasis on NSFW, this is a vulnerability pertaining to .edu and .gov domains that you seem to have discovered that there’s a little bit of it was something that wasn’t necessarily they had on their radar, but it seems as if OnlyFans takedowns are helping .gov and .edu domains protect themselves a little more. Why don’t we just start from the beginning on what exactly you were looking for and how you found out about this?
Greg Pollock Sure, I was conducting a kind of routine investigation of a website that had other indicators of compromise. And as part of that process, I go to Google, I just search across that site to see what’s going on with this thing. At the bottom of that page, at the bottom the search results, I see a little notice that I had never seen before, which said some results have been omitted because of DMCA notices against the content. So I click through and there I see a DMCA takedown notice from clearly an adult content creator, sent to mostly adult content piracy sites, but also this government domain that I was looking at. I thought, well, that’s pretty weird. What’s going on there? And so pulling on that thread led me to discover how this is happening across lots of domains and how those DMCA copyright notices can be a pretty effective way to look for domains that are somehow advertising search results they don’t mean to.
Eric White And when you say they are advertising, so when they compromise, they are essentially piggybacking on government website that would pop up in a normal search for, you know, for a government website, or for a governments resource or university resource. But all of a sudden, going down the search results, you see a title that you weren’t searching for, let’s say.
Greg Pollock Yeah, exactly. This is sometimes called parasite SEO and it’s a way for attackers to get traffic to their sites by finding websites that have some kind of vulnerability that allows them to start getting, you know, the names of their sites or even, you know links to their sides Into search results and they especially target these higher ed and government sites because those are trusted sites that Google says, hey, this is a really trusted site. I want to put this high up in the search ranks. And yeah, so that’s one of the many factors. That’s combining here to make this an especially juicy target for these attackers.
Eric White Gotcha. All right. And so, you know, what does it say that OnlyFans has now become a kind of early indicator for a vulnerability that would be on a site that Google has up there because it is so highly trusted? And are the powers that be who run those websites and control those websites, are they actually utilizing it? Did you hear anything on that front?
Greg Pollock Oh, are they utilizing this detection method?
Eric White Yeah, I mean, yeah are they saying hey, this is obviously showing a problem here that we have to address
Greg Pollock You know, I don’t think anyone is approaching it this way. And actually, I mean, part of that is because as I was doing this research, I found that this intersection of the copyright notices and the government sites is really fairly new. I mean this is really, this has really taken off in the last five years that you can use these data sets in this way. That said, I mean, this kind of problem of attackers compromising those sites to piggyback and have parasite SEO, that’s been going on for a long time. I think what we can do with this is really shorten the window of detection because eventually someone’s gonna see it and tell them, right? Like it really stands out like a sore thumb when you see that. So eventually someone does see it who will report it, but it usually takes quite a long time. And you can find some that have been out for ages, but you also find organizations that are better at detecting it. This might be a faster way to do that.
Eric White Gotcha. All right. And so if the copyright’s, I guess, detection by copyright enforcement ecosystem, is that an overall better way that might be available to finding these vulnerabilities rather than something that is just waiting in the dark that you never hear of and until, you know, you see compromised information on the dark web or whatever have you.
Greg Pollock Well, I mean, really what the attackers are taking advantage of here are just the organizational complexity of governments and universities that operate really large digital infrastructure over really long periods of time. And that organizational complexity leads to unmaintained websites, which creates this kind of a low-hanging fruit. And so the best option is just for these teams, which are always resource constrained and always asked to do more with less. For them to have enough people and the right tools to be able to take care of those sites proactively. This kind of like after the fact detection method and, like you were saying dark web detection, that’s even further down the chain. You really want to catch it sooner by giving them the tools to understand their own infrastructure ahead of time.
Eric White We’re speaking with Greg Pollock. He is the Director of Research and Insights at UpGuard. And was there anything that you came across — obviously, it’s kind of surprising when you come across this stuff when you’re searching for a government website — but in your research and seeing all of these DMCA takedown requests, was there anything that stuck out to you and kind of challenged what you were originally assuming that, you know, hey, obviously this stuff is going to happen, but was there something else at play here that you didn’t think that you would see.
Greg Pollock I mean, I’ll tell you the biggest surprise was just how recent this phenomenon is. That when I had gotten my data together and then created my charts, it’s really in the last five years that the chart starts to take off where you see this intersection of the copyright notices and the government and education websites. If I had done this project three years ago, the results would have been really pretty unremarkable and we wouldn’t be talking today, but it’s really a convergence of two things. One, the increase in cyber crimes, especially targeting Americans and the increase in the number of individual copyright owners creating adult content. And so those two things have created this convergence. And it’s really a surprise when you stumble into something big that no one has discovered and you think, you know, this is actually a new thing that’s pretty important.
Eric White Yeah, I imagine that they’re not doing this to try and amplify any particular content there. There is some means to sort of game the system of using that content to get access to other people’s information, right? They’re not just doing this out of the goodness of their hearts to help their local OnlyFans Creator?
Greg Pollock Yeah, that’s exactly right. Yeah. So these cyber criminal organizations are really complex and operate really technically impressive infrastructure themselves. And the top of the funnel, I mean, you can think of it like a business. The top of the final is they’re trying to get users into their system. And where do you get users to visit your website? Well, through Google search results. So this whole thing is, you know, and what do people search for? What do people want? And also what do you people want to pirate? Well, if there is paid adult content that someone is offering you for free, that becomes a pretty good lure and also for a certain audience who maybe is less risk averse, let’s say, and maybe ultimately a good target for your financial exploitation scams.
Eric White All right, and anything that any other conclusions that you came away with in how this kind of stuff can be stymied out even more and Security teams could adopt any sort of methods to be on the lookout for it other than seeing a Nefarious website pop up whenever they search their team’s name
Greg Pollock Yeah, I mean, I think the lesson here is really not that defenders are doing a bad job or that they don’t know about this. This is really a cybersecurity fundamental question. And the people tasked with defending these websites are aware that they want to have an inventory of their websites. They want to know what software it’s running. It’s really the resource constraints on those teams. And so this project, which, you know, as we’ve talked about, it’s kind of a funny juxtaposition of like these serious websites and this unusual content. This is really a way to get the interest of everyone else around them to say, hey, these teams are trying to defend your websites. They need more resources to do it and to shine a light on those cyber security fundamentals that unlike the OnlyFans models, they don’t always get the attention they deserve.
Eric White Yeah, and it kind of shows, and I know this is kind of outside the parameters of what you were looking at, but I mean, is there any other industry that faces more copyright infringements than the adult and entertainment industry? Because you know, obviously, their stuff is being infiltrated all the time. Is there anything that they might be able to do to kind of put a stop to this on the front end and protect themselves?
Greg Pollock Yeah, you know, we talked with a successful OnlyFans content creator about, you how much of a problem is this? And she said, yeah, if you don’t have some kind of brand protection software doing this for you, then you might as well not even try it because the piracy is so rife in that industry. There are other industries that face it as well. And looking through the DMCA notices, that I wanted to filter out everything that wasn’t adult content, just to kind of tighten the analysis here. And so you see a lot of piracy of sports streams. And you see a lot DMCA notices also related to illegal gambling sites. So those are some of the other forces at work in our digital ecosystem where people want certain kinds of content, you know, adult content, sports streams, et cetera. Attackers are well aware of the demand for that and are gonna use it to try to get eyeballs onto their sites and away from legitimate sites.
Eric White Utilizing DMCA notices as a snapshot of what folks are really into.
Greg Pollock Yeah, I mean, you know, you maybe know intuitively what are people interested in, but it really puts the rubber meets the road at like, what are they willing to pirate?
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
