OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear

Adult content creator Laura Lux says she has been publishing pictures of herself online for almost two decades. She primarily posts on OnlyFans these days, but she previously used Patreon and at one point hosted her own subscription website. No matter the platform though, people have always tried to steal her content and “leak” it online. “It’s an endless battle,” says Lux, who uses her creator name for privacy reasons.

“We do lose a lot of money just because the content is literally a Google search away a lot of the time,” Lux says, describing the murky online underbelly, mostly made up of men, that shares and trades pirated adult content. However, as the adult creator economy has boomed in recent years, individual OnlyFans models and other adult creators have increasingly joined Hollywood, music studios, and publishing houses in the fight against pirated content.

Content creators have filed millions of requests under copyright laws, with successful requests under the Digital Millennium Copyright Act resulting in pages hosting stolen pictures and videos being removed from search results. “If you are not running a DMCA service, then you might as well probably not even be bothering doing the job, because it will be everywhere,” Lux says.

However, these DMCA requests, which are often made by companies representing adult content creators, have also collided with one of the internet’s long-standing problems: insecure government and university websites. More than 2,000 domains belonging to governments and education institutions, across 80 countries, have received copyright takedown requests linked to adult content creators over the past 15 years, indicating the sites may have been compromised, according to a new analysis from cybersecurity company UpGuard and shared with WIRED. Many of the sites have been repeatedly compromised amid a “dramatic” increase in hijackings related to individual adult creators and their “leaked” OnlyFans content since 2020, UpGuard’s research says.

For years, scammers have hijacked official websites, which have authoritative .gov and .edu domain names that often appear high in Google search results, to upload malicious pages and PDFs pushing claims of free movie downloads, iPhones, porn, and Fortnite skins. These pages then often link to scams or malware downloads. Increasingly, the fraudsters behind the schemes have been using the names of adult content creators to draw victims to their compromised pages.

“The OnlyFans models are not setting out to help government websites, but in order for them to police their copyright ownership, they wind up sending a lot of notices to Google about those sites,” says Greg Pollock, the director of research at UpGuard. “In some ways, because of the way the attack works, having Google remove the search result is extremely effective, because there’s no real visibility of the asset outside of Google.”

Some of these recent copyright takedown requests seen by WIRED include government and university websites in Bangladesh, Colombia, India, Nigeria, the United States, and Peru. The infected pages are common. Search results viewed by WIRED show .gov and .edu domains with pages titled “biggest leak yet” and “leaked OnlyFans” videos alongside the names of adult content creators who have millions of followers.

If clicked, the URLs in search results do not show leaked pictures or videos and often redirect visitors to scammy URLs that advertise online dating and other suspicious pages—potentially earning fraudsters money through complex advertising schemes. To upload the malicious content, scammers may exploit weaknesses or vulnerabilities in the publishing systems of websites.

Pollock’s analysis says there have been 384,286 takedown requests, covering 631,193 URLs, from adult content creators to government and education websites since 2011. The vast majority have been sent in the past few years. Of these requests, Google appears to have removed around 130,000 of these URLs, with no action being taken against 460,000, Pollock’s analysis says.