Laura Lux has been sharing images of herself for nearly twenty years. It is a grind. She used to host her own site, tried Patreon, and now lives on OnlyFans. The platform doesn’t matter. The theft always happens.
“It’s an endless battle.”
Leakers find her work. Mostly men. They trade pirated files in the murky corners of the web. It hurts revenue, sure, but the real loss is control. Her content becomes a Google search result away. Everywhere. Now she fights it like a studio lawyer would. Filing takedowns. Using the Digital Millennium Copyright Act (DMCA). It works. If you aren’t filing DMCA notices, you aren’t even trying.
Here is where it gets weird.
The notices are pinging government and university websites. Across eighty countries. Two thousand domains. Compromised. Hijacked. Scammers love the authority of .gov and .edu. They hack them to drop malicious pages promising free iPhones or Fortnite skins. Recently though they have switched tactics. They use the names of adult creators. Bait.
Search for a top creator? You might hit a hacked page in Bangladesh. Or India. Or Nigeria. The page title screams “leaked.” The user clicks. Nothing is there. No nudity. Just a redirect to a sketchy dating site. The scammer makes ad money. The user gets malware.
OnlyFans models didn’t mean to do this. They are just cleaning house. But their aggressive copyright enforcement is lighting up security vulnerabilities they didn’t know existed.
“In some ways because of the way the attack works having Google remove the search result is incredibly effective”
Greg Pollock runs research at UpGuard. His data is stark. Since 2011, adult creators have sent 384,284 takedown requests targeting official domains. That covers 631,180 URLs. Most came after 2020. A spike. A surge. Google deleted about 130,004 of those links. They left 460,595 alone.
How did they find this? Pollock combed through Google transparency reports and the Lumen Database. He cross-referenced notices against known “leak sites” and the companies that police them. It turns out a huge chunk of this traffic comes from one place. Rulta. An Estonia-based firm. They filed roughly ninety percent of these requests in recent years.
Google insists its spam filters work. Chrome warns you if a site is dangerous. They claim DMCA takedowns apply to single pages, not whole domains.
But Dan Purcell thinks otherwise. He runs Ceartas, helping creators delete pirated content. To him, a compromised government page ranking high is a “near-perfect funnel.” Users searching for leaks are primed to click. Recklessly. They lower their guard.
Yet Purcell has a bone to pick. DMCA is the wrong hammer. The government isn’t hosting porn. The scammers are. The site is a victim. Filing copyright strikes against a breached .gov is aggressive. Wrong. “Just because it smells funny doesn’t mean you execute the most aggressive law possible.”
Law professor Jennifer Urban agrees. DMCA was meant for copyright. It got abused for SEO problems. When a takedown notice drifts outside pure copyright infringement, it gets questionable. Even if the complainant is sympathetic.
Some removal services push back on the chaos. Fanlock’s cofounder Alexander Small draws a line. If the page uses a creator’s name as bait but shows no content, it is not copyright theft. They don’t file. They stick to good faith.
There are eleven thousand adult creators linked to these requests. Five hundred fifty-four organizations fighting them. It is messy.
But here is the upside. Small security teams at universities and town halls are blind to their breaches. Until a fan sends a takedown notice. Until their server is flagged for “adult content.” It acts as an alarm system. A weird, accidental early warning.
Lux isn’t shocked. Her brand is on domains in Brazil, Vietnam, Somalia. She knows her stuff is everywhere. When you make a living on the internet, you leave footprints. Scammers follow.
Does it bother her that her takedowns expose weak government security?
“I guess sex workers save the world again.”
The sentence hangs. There it is. Unearned. Accidental. Effective? Maybe. The breach is still there. The vulnerability remains. She just turned on the lights.
