Adult creators routinely battle scammers and pirates stealing their pictures, videos, and sometimes even identities. Now, that exhausting cleanup job is producing an unexpected side effect that involves cleaning up government websites.

Scammers have been compromising trusted .gov and .edu domains and stuffing them with pages advertising supposedly leaked OnlyFans content. This has even lead to hacked government and university websites are disappearing from Google Search. The pages frequently contain no stolen material at all. Instead, they use popular creators’ names to lure people toward dating scams or other kinds of suspicious advertisement and malicious downloads.

Scammers are borrowing the government’s Google ranking

The technique is known as parasite SEO. Attackers exploit vulnerable websites with strong reputations and search authority, allowing their scam pages to appear more credible and rank higher than they would on a newly created domain. Government and university sites have become really attractive targets because users end up instinctively trusting their addresses.

cyberscam-romance-scam — Mohammed Hassan / Pixabay

An analysis from cybersecurity company UpGuard (via WIRED) identified adult-content-related copyright complaints involving 2,167 government and education domains across 80 countries. Its dataset covered 384,286 takedown requests and 631,193 reported URLs between September 2011 and May 2026. Those domains included 646 government websites and 1,521 educational institutions.

The problem has become considerably more visible since 2020, as OnlyFans grew and thousands of individual creators began employing specialized companies to search for pirated material. This ended up creating an enormous network of scanners constantly looking for creator names, images, and supposed leaks across the web.

Copyright complaints became an accidental security tool

So when those scanners discover suspicious pages on compromised government domains, removal companies can submit Digital Millennium Copyright Act complaints to Google. UpGuard found that Google removed 132,266 reported URLs, while more than 468,000 received no action and roughly 20,000 were already absent from its index.

Removing a search result does not repair the vulnerable website. It can, however, cut off the scammer’s main supply of unsuspecting visitors since many such pages have almost no visibility beyond Google. Unfortunately, scammers have caught on to this process, often using Some pages merely use a creator’s name as bait without hosting copyrighted material, leading cybersecurity and legal experts to question whether DMCA complaints are always the appropriate response.