Fake OnlyFans leak sites now look like ordinary websites: 133 of 213 new names have no adult word

Fake OnlyFans leak sites no longer need a leak-site name. We read fifteen years of Google's copyright records and found them on hacked schools, ministries, car dealers and small shops.

Source Google Web Search copyright removals · Window 2011-03-10 → 2026-05-04 · Method the full export, filtered to filings by creator-protection agencies, domain names sorted by the words in them

Key findings

• Of the 213 newest confirmed leak sites, 133 have no adult word in their name.
• Agencies reported pages on over 2,600 school and government websites.
• Google said no to about 69% of the pages reported on those websites.
• On confirmed leak sites, Google said no to only about 4% of reported pages.
• 586 new sites ending in .garden showed up in Google's records within one month.

The find

What is OnlyFans parasite SEO, and why is my name on a dentist's website?

Someone broke into the dentist's website and added pages to it. This trick is called parasite SEO. Google trusts the old website, so it shows the new pages high in search results.

The new pages carry the names of popular creators and the word "leaked." Many of them have no stolen content at all, Digital Trends reported. They use creators' names to pull people toward dating scams and harmful downloads.

Agencies search Google for their clients' names. When they find such a page, they report it. That is how a dentist, a school or a ministry ends up in Google's copyright records.

In July 2026, a security company called UpGuard found these pages on nearly 2,200 government and school websites. Those websites were in 80 countries. We used a different method and looked further, beyond schools and governments.

Institutions

Which hacked government websites show OnlyFans leak pages?

Agencies reported pages on over 2,600 school and government websites. They did this for over 13,000 different creators.

Nearly 1,200 of these websites were first reported in 2025 or later. Of all 2,610, 13 meet the bar for our confirmed list on their own. 10 of those 13 were first reported in 2025 or 2026.

School and government websites that meet the bar for a confirmed leak site. Every one of them is the victim of a hack, not a leak site by choice.

Another 86 school and government websites are on our grey list. That list holds sites with some reports, but not enough proof to name them. We do not name them here.

31 of these 86 were reported for over 1,000 creators each.

Of all 2,610, the biggest group by ending is plain .edu, with 475 websites. Next come Vietnamese schools on .edu.vn and Indonesian schools on .ac.id.

It was still going on when Google's data ends. Of the 13 confirmed school and government websites, 12 were still reported in April or May 2026.

Outcome

Does Google remove fake OnlyFans leak pages?

Mostly not. Agencies reported over 1.7 million pages on school and government websites. Google said no to about 69% of them.

On confirmed leak sites, Google said no to only about 4% of reported pages. A copyright request says the page holds a copy of the creator's work. If the page holds only a name and a link, Google has nothing to remove.

That comparison is not fully fair. A site gets on the confirmed list only after Google removed at least 5,000 of its pages. So we also checked new domains picked without that bar. On new domains with no adult word in the name, Google said no to 5.2% of reported pages.

Not every hacked school holds only empty pages. The 13 confirmed school and government websites got on the list because Google removed many pages there. On those 13, Google removed about 46% of reported pages.

"New domains" are domains first reported in 2025 or later, for at least 50 creators. "Not on Google" means Google never showed the page, so there was nothing to remove. Pages still waiting for a decision make up the rest of each row: 0.3% for school and government websites. The confirmed list does not split "not on Google" from "still waiting", so its other 33.2% holds both.

Some hacked shops and small businesses are different. On the ones in the next section, Google removed most of what agencies reported. On worlddental.ca, it removed 99.9% of reported pages. Those shops are on the confirmed list, so they were picked for having many removed pages.

So those pages did hold copies of creators' work. Some hacks plant empty pages with names. Others plant the stolen photos and videos themselves.

Low removal rates have more than one cause. A low DMCA removal rate doesn't mean a site is legit explains the main one.

Businesses

Why is a Honda dealership on a list of leak sites?

For the same reason as the ministries. 213 domains joined our confirmed list in 2025 or 2026. We checked their names against 68 adult, leak and creator words, like "porn", "nude", "leak" and "onlyfans."

133 of the 213 names had none of these words. Many are ordinary businesses.

Confirmed leak sites first reported in 2025 or 2026 with no adult word in the name, largest by creators. Each site is described by its home page in 2023 or 2024, as the Internet Archive saved it. Some of these sites are offline now or show other content.

We also sorted the newest confirmed leak sites by hand. Of the 135 first reported in the last year of the data, 59 look like ordinary websites.

Each site in the table above was reported by at least five different agencies. That is the same proof we ask of a real leak site. While the hack lasts, fans who search a creator's name find the dealership.

Europe

Where are the hacked websites with OnlyFans leak pages?

Many are on European endings like .eu, .pl, .de and .fr. We track over 8,100 domains on these endings. About 71% of them were first reported in 2025 or 2026.

Google's records go back to 2011. So most of these domains arrived in the last 16 months of a fifteen-year record.

Domains on the confirmed list and the grey list together, every European ending with over 100 domains, largest first. 21 European endings in all: 8,181 domains, of which 5,782 (70.7%) were first reported in 2025 or later.

The .eu ending stands out. Nearly 3,500 of its domains are new since 2025. Almost all of those have no adult word in the name.

Farms

What is a .garden domain doing in a leak list?

It is one of 586. These sites do not look hacked. They look made in a batch, on a cheap new ending.

All 586 .garden domains were first reported between 4 April and 3 May 2026. Google removed 99% of the pages reported on them. So Google found copies of creators' work there.

Three of them meet the bar for a confirmed leak site. Their names show the pattern:

• winkingplay.garden
• sexyflirts.garden
• sweetkisses.garden

Most other big .garden names are two short English words joined together. On .rest, many names are made-up words instead.

Domains we track on four cheap new endings and on .my, Malaysia's country ending, by the month they were first reported. "Creator reports, summed" adds up the creators named on each domain, so one creator can count many times.

Almost all the .garden, .rest and .casa sites are on the grey list, not the confirmed list. Leak sites also open copies of themselves on new domains. One leak site, 164 domains shows how much those copies hold.

Growth

How fast is this growing?

Fast. In January 2024, 491 new domains joined the domains we track. In April 2026, over 3,800 joined.

Over 3,200 of those April domains had no adult word in the name.

Domains on the confirmed list and the grey list, by the month they were first reported. Google's data ends on 4 May 2026.

Traps

Three ways this data will lie to you

Verdict

What this adds up to

Fake OnlyFans leak sites no longer look like leak sites. Many are real schools, ministries and shops that someone broke into. Others are batches of new sites with harmless-sounding names.

For anyone protecting a creator, two things follow:

• Search Google for the creator's name, not just for known leak sites. The new places do not use leak words.
• When the page sits on a hacked website, a copyright request may fail. Tell the site owner, or use Google's other ways to report a page.

Data & method

• Source. Google's Web Search copyright removal export, cut on 2026-05-04. Window 2011-03-10 → 2026-05-04.
• Creator filter. Only requests from 2,077 reporting organisations that match creator-protection agencies. The same filter builds our lists.
• School and government websites. Domains ending in .edu, .gov or .mil, with or without a country part, or in .ac. plus a country, such as .ac.in. The bare .ac ending (Ascension Island) is left out, because leak sites use it. Across the creator-agency record: 2,610 domains, 13,419 distinct creators, 1,754,766 URLs reported, 380,668 removed (21.7%), 158,451 not in Google's index (9.0%), 1,210,222 with no action (69.0%). 1,178 were first reported on or after 2025-01-01. 99 are on our lists: 13 confirmed, 86 grey.
• Confirmed leak sites, for comparison. Sums over all 4,061 rows of the confirmed list: 968,618,713 URLs reported, 63.0% removed, 3.7% no action. Among the 40 confirmed sites with the most creators, no action ranges from 0.2% to 8.2%.
• Adult words. A list of 68 adult, leak and creator words, matched anywhere in the domain name. "No adult word" means none of them matched.
• New confirmed leak sites. Confirmed domains first reported on or after 2025-01-01: 213, of which 133 (62.4%) have no adult word.
• Hand sort. The 135 confirmed leak sites first reported between 2025-05-04 and 2026-05-04, sorted by hand by their names: 59 ordinary websites, 25 copies of known leak sites, 25 new adult or leak sites, 14 word-plus-"onlyfans" sites, 12 random letters.
• European endings: .eu .pl .de .fr .it .es .nl .cz .sk .at .be .pt .se .dk .fi .no .hu .ro .gr .ie .ch, over the confirmed and grey lists together (85,384 domains in all).
• Outcome by name. Every domain in the creator-agency record first reported on or after 2025-01-01 with at least 50 distinct creators: 13,694 without an adult word, 2,618 with one.
• Farms. Confirmed and grey domains on .garden, .rest, .casa, .blog and .my (Malaysia's country ending, cheap to register), grouped by the month of their first report. .garden: 586 domains, 3 confirmed, first reported 2026-04-04 to 2026-05-03, 1,334,066 of 1,347,485 URLs removed (99.0%).
• External. UpGuard, Adult supervision: how OnlyFans takedowns quietly police compromised domains (8 July 2026), and coverage by Digital Trends via WIRED. UpGuard started from known leak sites and known creators, and counted 646 government and 1,521 school domains. Its count of 2,167 is not directly comparable to our 2,610.
• What the data cannot show. It does not show what is on a page today, how a site was hacked, or whether the owner has cleaned it up.

Other posts built on the same data are on the Raynim blog.

Corrections

No corrections yet. To request a correction or the removal of a domain name from this post, write to hello@raynim.com. See our corrections policy.

FAQ

Are OnlyFans leak scam sites dangerous? Yes, for anyone who clicks. Many fake leak pages on hacked websites hold no stolen content. They use a creator's name to send people to dating scams and harmful downloads. The batch sites, like the .garden ones, do hold stolen images.

Why does a university website show my name with "leaked"? Someone broke into the university's website and added a page with your name. Google trusts the university, so the page ranks high. Agencies have reported pages like this on over 2,600 school and government websites.

What is parasite SEO? It is adding pages to a trusted website without the owner knowing. Google trusts the website, so it shows the pages high in search results. Here, those pages use creators' names and the word "leaked."

Will a DMCA notice remove a fake leak page? Often not. Google said no to about 69% of pages reported on school and government websites. A fake page holds no copy of your work, so there is nothing to remove. Tell the site owner, or use Google's other ways to report a page.

What we do with this

Our free scanner searches Google for the name your fans use. It checks each result against the domains we track, including the hacked websites and batch sites in this post. You do not need an account or a card, and you do not upload anything. Check your name.