UPGUARD researchers, via a Deep Dive into copyright takedown activity surrounding OnlyFans and other adult content creators, have uncovered a broader trend: attackers are abusing vulnerable university and government websites to manipulate search results.
The investigation, discussed by UpGuard’s Greg Pollock in a Dark Reading interview, shows that when sites are compromised to promote unauthorised content, the resulting DMCA takedown notices can reveal the underlying access points and weaknesses that security teams should monitor. In effect, copyright takedown requests become a historical signal indicating where a site has been tampered with, even if the incident itself is not detected in real time.
Pollock explains that the chain of events starts with search engine spam and escalates when brand-protection services and content creators report pirated material. Google’s Transparency Report—which lists around 18 billion copyright requests—contains an all-time high for a major adult brand, with government and education sites occasionally appearing in takedown data.
While the signal is not a live detection tool, it provides a broad archival view across vendors and third parties, useful for post-hoc investigations and for assessing long-term risk across an organisation’s digital footprint. The discussion emphasises that universities and government sites are attractive targets due to high authority in search results and their large, dispersed, and often under-resourced infrastructures.
Practically, the piece urges security teams to treat this as a governance and asset-management issue as much as a technical one. Monitoring search results for one’s domains, auditing back catalogues, and ensuring core web security practices (CMS updates, input sanitisation, and avoidance of open redirects) are key. It also highlights the need for senior buy-in to fund ongoing follow-up and archival analysis, given the accelerating scale of this trend and the breadth of domains potentially affected.