- UpGuard's Greg Pollock says copyright takedown filings by adult content creators can reveal compromised university and government websites that attackers use to manipulate search results.
- The archive goes back to 2011 and is slow, so Pollock says it suits checking vendors and third parties, not monitoring your own site.
- Pollock says the fixes are known web security basics; leaders should fund inventory and upkeep of old sites, and ask how attackers got in.
Your website may be compromised, and one of the outside signals may be an automated copyright takedown filed for an adult content creator. That is the unusual finding from Greg Pollock, director of research and insights at UpGuard. He described it in an interview with Dark Reading's Kristina Beek.
The lesson here is that a compromised site can leave a trace in systems its owner does not run. Those systems were built for another purpose. Security teams can read them, and so can anyone checking up on your organisation.
How a copyright filing points to a hacked site
Pollock began with search engine spam. Attackers find a website they can tamper with and plant content so that search results show their material. He said this content is very often adult in nature.
While investigating one compromised site, he searched Google. At the bottom of the results page he saw a notice that some results had been removed after DMCA complaints. DMCA is the US copyright takedown law. The site was a legitimate government website. It had been reported for using the names of adult performers.
That was odd, he said, because the other sites in the same complaint were piracy sites. The reason is the chain that follows. Creators now use brand protection software that searches the internet for their names and likenesses. When it finds a match, it files a report with Google. Google publishes the notices in its Transparency Report. A hacked government page carrying planted content gets swept into the same process.
Pollock said Google reports about 18 billion copyright removal requests received. Most concern ordinary media piracy. He also said the adult industry has shifted from a few large studios to millions of individual creators. Each has a financial reason to hunt for copies of their work.
Why universities and agencies are the targets
Pollock gave two reasons these sites show up often. First, Google treats .edu and .gov domains as high-authority, so it ranks their pages well. A hacked page on a site nobody visits will not surface in search. A hacked page on a university domain can.
Second, these sites are easy to exploit. Pollock described institutions with large digital footprints and tight budgets, where things are set up and then left running. A university hosts student clubs, computer science coursework and professors' research projects. Pollock said that scale makes forgotten, unmaintained pages likely.
Put plainly, the attacker is borrowing the trust Google places in the institution's domain. The institution may not notice until someone else does.
Embarrassing symptom, uncertain cause
Pollock separated the visible symptom from the underlying harm. A spam page might be only embarrassing. But he said the same access that lets an attacker plant text could let them place malicious JavaScript. That could allow data theft or harm to visitors.
So the spam is not the measure of the problem. The question is how the attacker got in and what else that access allows. Pollock said teams need to work out why the search results appeared before judging the harm.
What the archive can and cannot do
Pollock was direct about the limits. The data arrives slowly. Brand protection software finds the content, the creator reports it, Google processes it, and only then does it appear in the transparency report. He said it is not a way to monitor your own website for compromise.
Its value is breadth and memory. Pollock said it covers an archive going back to 2011. A compromised site may be fixed and then vanish from Google's cache, which makes past incidents hard to reconstruct. The takedown archive lets a team check many companies at once. It can also show whether a prospective vendor has appeared in it before.
One caveat on this account. It rests on a video interview. The published transcript is edited and cuts off before Pollock discusses how fast the trend is growing.
What leaders should ask
Pollock said the fixes are known web security basics. They include updating the content management system, checking for cross-site scripting and closing open redirects. The hard part is time and money to cover everything the organisation ever put online, not just new sites. He said the people who fund security teams need to know the threat is ongoing and that those teams need more.
Four questions follow. Does anyone hold a complete list of every site and subdomain under our names? Who owns the old projects, club pages and research sites? Have we checked our key vendors against the takedown archive before renewing? And when a spam result appears, does the team investigate how the attacker got in, or only remove the page?
A spam page can be the whole story or the visible edge of one. You only find out by investigating.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Dark Reading.
