All Five of Google’s Top Results for “Best AI Porn Apps” Are Spam. Four Run on University Pages.

The top of Google, taken over

One search: “best ai porn apps.” This is who actually holds the top five organic spots. Pink is a university. Violet is a software company. None of them know they are there.

US organic results, measured 19 July 2026. There is no genuine result in the top five. Every position is planted content.

How a university ends up selling porn apps

None of these organisations uploaded anything. The trick is called parasite SEO, and it is parasitic in the literal sense. Attackers do not build their own trusted website. They borrow one. They find a feature on a domain Google already respects, a public fundraising page, a journal system, a form that accepts file uploads, a job board, even a bug tracker, and they use it to plant a page. Google sees a Cornell address and assumes the content is worth trusting. It ranks. The visitor gets funneled to adult affiliate offers. The institution never knows.

Across our data the hijack falls into six repeating shapes:

• Journal-software redirects. Outdated academic publishing systems whose document viewer can be bent into a cloaked redirect. Seen on Cornell Law, George Mason, and the University of Technology Sydney.
• Form-upload directories. Public web forms that save uploaded files where Google can crawl them. Seen on MIT, and on the state-government sites in our first report.
• Fundraising page hijacks. “Start your own fundraiser” pages, seeded with spam. Seen on Roosevelt, Eastern, and a hospital charity.
• Job and careers listings. Open submission of listings or applicant files. Seen on two nonprofit portals.
• Bug-tracker attachments. File attachments served from a trusted corporate domain. Seen on Google’s own Chromium tracker.
• Shared-document platforms. Collaborative document tools that publish user-created pages on a trusted company domain. Seen on Benchling, a biotech software platform, holding position three.

We are not publishing the exact URLs or upload methods. Every affected institution and Google received the full technical detail directly, so the pages can be removed without handing the next spammer a recipe.

The eleven, named

Every host below is a victim, not a participant. Positions are US organic, 19 July 2026.

Zero of these eleven appeared in the nine hosts we documented on 12 July. Combined, that is twenty organisations in two weeks, and we were not looking hard.

The prize they are fighting for

Ten commercial terms. More than 135,000 American searches every month, over 1.6 million a year, from people ready to spend money. This is the real estate the spam network is quietly occupying.

Monthly US search volume per term. Measured by Sindexed, 19 July 2026.

What it costs, in plain numbers

Here is the honest version, floors not fantasies. On the positions we personally verified, the spam intercepts a floor of about 1,050 buying-intent clicks every month, roughly 12,600 a year, from people who wanted a real product and got a hijacked .edu instead.

The dollar range is deliberately conservative. Google bans adult advertising, so this traffic cannot be bought on Google at any price. On the adult ad networks where it can be bought, a click like this runs anywhere from 75 cents to three dollars. Apply that to the traffic we verified and you get roughly 9,000 to 38,000 dollars a year, from four search terms, on the day we happened to look. Widen it to a realistic one to two percent capture of the whole category and the figure moves toward six figures a year. Every new host and every long-tail term pushes it up, never down.

Who pays, and who cashes in

Three groups lose. The institutions, whose good name is being used to sell adult content without their knowledge, and whose search reputation Google may punish for hosting spam. The person searching, who is quietly routed toward affiliate spam and possible malware. And every legitimate platform in the category, which does the honest work of building a product and then watches a hijacked university page take the click it earned.

One group wins. The affiliate operators who run this, and whichever platforms buy their redirected traffic. We are not naming the platforms that receive it, because doing so responsibly means following live hijack chains we have chosen not to publish. Tracing the money to its destination is the obvious next chapter, and we are working on it.

One more thing the data says

The spam is not spread evenly. It clusters on the buying words, “generator,” “porn,” “nude,” the searches with a wallet behind them, and it barely touches “girlfriend” or “chat.” These operators are not random vandals. They are following the money with a precision Google’s own spam team has not matched.

How we did this, and what we held back

On 19 July 2026 we pulled the top 20 to 25 US organic results for fourteen of the highest-demand adult-AI search terms and logged every university, charity, government or corporate host holding a first-two-pages position. Search volumes are our own measurement. Click estimates apply published organic click-through rates to each verified position, and are stated as floors. Rankings reflect the day we measured and will change as hosts clean up. Every host is a victim of a hijack. We make no claim that any institution created or approved this content.

Before publishing we notified the security teams of every named institution and Google’s security contact, with the specific URLs and methods, so the pages can be removed. We withheld those URLs and methods here on purpose, so this article documents the problem without teaching the next attacker how to repeat it.