Fake DMCA takedowns on Google: 0 of nearly 47 million requests are flagged as abuse
Raynim Research · Note · · 9 min read
Google publishes every copyright takedown request it gets. Each carries a yes/no "From Abuser" flag. We found thousands of fake takedowns there, and the flag marked none.
Most of these senders target casino and news sites. A group of 68 agency names filed real takedowns for creators, and the flag says nothing about them either.
Key findings
- Google's "From Abuser" flag says no on all nearly 47 million requests. Every single one.
- Over 11,500 accounts posed as Indonesia's government. Their main target: gambling sites.
- One casino copy got 8,932 reports, each from a new account. Google acted on none.
- Dozens of new "agencies" share 92% of their creators. Looks like one company in many costumes.
The field
What is the From Abuser flag in Google's copyright data?
Google's "From Abuser" flag says "yes" in 0 requests. The record comes as three large files, each ending in this field. Google's notes say it marks requests "from someone we believe to be abusing the process."
| File (one row per …) | Rows | Flag = yes | Flag empty |
|---|---|---|---|
| requests (takedown request) | 46,891,226 | 0 | 0 |
| domains (site named in a request) | 855,087,358 | 0 | 0 |
| urls-no-action-taken (page Google left alone) | 412,304,776 | 0 | 0 |
Google's three copyright removal files, counted row by row.
Over 1.3 billion rows in total, all "no", none blank. A field that never changes tells the public nothing.
Abuse
Who files fake DMCA takedowns pretending to be a government?
Over 11,500 accounts used a name with both "government" and "Indonesia" in it. They sent over 47,000 requests between May 2025 and May 2026. The six names in the table cover about 10,800 of those accounts, mostly aimed at gambling sites.
| Name as filed | Accounts | Requests | Pages removed | Pages with no action |
|---|---|---|---|---|
| government official indonesia | 7,200 | 33,339 | 33,495 | 1,035,260 |
| government from indonesian | 635 | 5,727 | 164 | 159,947 |
| government indonesia | 2,020 | 4,242 | 3,150 | 147,590 |
| government of indonesia | 817 | 1,011 | 1,080 | 10,068 |
| government indonesian | 67 | 784 | 0 | 7,495 |
| government offcial indonesia | 75 | 713 | 1,144 | 30,275 |
The six names with the most requests, spelled as the senders typed them.
One gambling site, kereta-rawontoto.pages.dev, was named nearly 22,000 times, counting every page of the site. Google removed none of those pages.
A name counts if "government" and "indonesia" are spelled right. So "offcial" is in. "goverment from indonesia" and "pemerintah indonesia" are not.
Why fake? 7,200 separate accounts typed the identical name "government official indonesia", and they went after gambling sites. The files do not say who runs them.
Abuse
What does a DMCA takedown scam look like in Google's data?
8,932 requests for one page, azino777-zerkalo.clients.site, a mirror of the Azino777 casino site. No page in fifteen years got "no action" more often (this counts one page address, not a whole site).
Each request came from a different account, between 18 March and 4 May 2026. Google took no action on any of them. The accounts used about 6,500 company-like names, such as "Green Harbor Consulting".
The record does not say who sent them or why.
| Page | Requests, no action |
|---|---|
| azino777-zerkalo.clients.site | 8,932 |
| a page on a site that is offline now | 8,753 |
| betasusguncelgiris.com (a betting site) | 7,645 |
| a page on a domain that now belongs to an unrelated business | 7,124 |
| vpk.name (an article about a casino) | 6,991 |
| wwt.proqualis.net (a casino guide) | 6,886 |
The pages Google took no action on most often, from all senders. Two pages are not named: we could not tell what they were when the requests were sent.
The last page in the table, wwt.proqualis.net, shows the same trick with made-up people like "Tomasz Kowalski". The senders were 6,877 accounts, all within two weeks of March 2026. Counting every page those accounts reported, not just this one, Google removed only 361 and left 21,689 alone.
Abuse
Can fake DMCA takedown requests be used to hide news and court records?
They were tried, and they mostly failed. Of nearly 14,000 pages reported, Google removed 304.
We found 17 sender names active only between 21 January and 9 February 2026. Together they sent 5,804 requests from 5,591 accounts, almost all with a single request each. The names sound like safety teams, such as "pin up brand safe partners" and "safety google search partners".
Most targets were casino sites, plus facebook.com and tiktok.com, then news and court-record sites. Each of these four was named exactly 409 times:
palmbeachpost.com, a local newspapernews-journalonline.com, a local newspapermugshots.com, which shows arrest photosunicourt.com, which shows court records
A copyright claim against a newspaper looks like an attempt to hide a story. The record does not say whose.
Three more names, "CopyGuard Plus", "ProofDefend" and "Rights Legion", used 348 accounts in early 2026. Most sent one request each. We did not pull this group's targets from the domains file, so we cannot say what they went after.
Competition
Can 68 different takedown agencies be one company?
68 agency names filed for a heavily overlapping group of creators. They all filed between September 2025 and January 2026. Some of the names are SecureReach, EchoSafe, CreatorShield, Media Sentinel and The Leak Patrol.
| Measure | Value |
|---|---|
| Agency names | 68 |
| Accounts | 1,796 |
| Requests | 82,611 |
| Pages reported | 1,334,410 |
| Pages removed | 1,134,094 (85.0%) |
| Different clients (creators) | 545 |
| Average number of the 68 names filing per client | 20.14 |
| Clients under two or more names | 503 (92.3% of 545) |
All 68 names together, 3 September 2025 to 25 January 2026.
Real competitors rarely share clients. Among the known agencies, about 1 in 10 creators is shared. These 68 share almost all of theirs, and they filed in the same months.
The record does not say who runs it.
Their main targets were confirmed leak sites, such as leakedmodels.com, thefap.net, picazor.com and leakgallery.com. Sites like these open mirror domains when one gets blocked.
Consequence
Why does an abuse flag that always says "no" matter?
Fake notices can remove real pages. In July 2026, Search Engine Journal reported that Google removed two news articles after complaints the publisher called "spurious".
Google says it is "not always able to verify the accuracy of the request".
Our confirmed-leak-site list counts only reports from known agencies. None of the 68 names is a known agency, so they cannot push a site onto our confirmed-leak-site list.
Traps
One way this data can fool you
Check that a field's values change before you trust it.
Data & method
- Source. Google's Web Search copyright removal export, cut on 2026-05-04, window 2011-03-10 → 2026-05-04. Three CSV files, about 80 GB: 46,891,226 requests, 855,087,358 request-domain rows and 412,304,776 URL rows with no action. All rows loaded, none dropped.
- Flag check. Rows where the From Abuser flag (
from_abuserin the data) is yes, and rows where it is blank. - Government names. Names containing both "government" and "indonesia": 47,491 requests from 11,563 accounts, 2025-05-12 to 2026-05-04, lowercased with spaces normalised. Other misspellings, Indonesian-language names and real bodies such as Kominfo (a communications ministry) and Telkom (a state phone company) are not counted. Targets come from the domains file joined on request ID.
- Pages with no action. The no-action file grouped by URL, senders joined through the requests file. Casino page: 8,932 requests, 8,932 accounts, 6,518 names.
wwt.proqualis.net: 6,877 accounts, 5,110 names, 6,910 requests in all (the table counts 6,886 with no action), 2026-03-12 to 2026-03-26. - Name groups. Sender name lowercased, stripped to letters and digits. 68 names (filter bounds): first seen 2025-08-15 to 2025-10-15 (earliest 2025-09-03), last seen 2026-01-10 to 2026-02-15, 100 to 300 clients, 500 to 4,000 requests. 17 names: filter bounds first seen from 2026-01-20, last seen by 2026-02-10 (actual: 21 January to 9 February), at least 20 accounts, at most 1.5 requests per account; 13,991 pages, 304 removed. Shared clients: distinct clients under two or more names (503 of 545 for the 68 names, 5,832 of 59,180 for the known agencies).
- Known agencies. The fixed list of creator-protection agencies behind our leak-site lists. Of 59,180 clients, 5,832 (9.9%) appear under two or more.
- What it cannot show. Who runs any of these accounts.
Corrections
No corrections yet. To request a correction or the removal of a domain name from this post, write to hello@raynim.com. See our corrections policy.
FAQ
Can a fake DMCA takedown be used for negative SEO? People try: fake senders went after news, court-record and rival casino sites. Google removed almost none of those pages and flagged no senders.
How do you spot fraudulent DMCA notices in Google's data? Look for many accounts with one request each, and names that all appear within days. One page reported thousands of times is another sign. Then check how many pages got no action.
Does Google's From Abuser flag ever say yes? Not in the public data: "no" on every one of nearly 47 million requests.
Is DMCA abuse a risk for creators? Not directly. The fake groups here mostly went after gambling and news sites. The 68-name group sent real takedowns against leak sites. The risk is that names in the record can be fake.
What we do with this
We are Raynim. Our free scanner searches Google for your name and checks the results against our list of 4,061 confirmed leak sites. No account, no card, no uploads. Check your name.