'AI porn' spam slips onto the University of Córdoba website: URL abuse is the underlying problem

By Universidad de Córdoba (UCO) · October 15, 2026.

The material received contains no article. It is a headline promising "AI-generated sexual content videos and wallpapers for adults, with age verification," tied to an address on the uco.es domain. There is no text, author or data we can verify about that content, so we do not treat it as valid.

The only verifiable element is the URL itself. It points to a virtual tour page of UCO's SCAI service and carries a long base64-encoded parameter (a format that turns text into a seemingly unreadable string of characters). Once decoded, it appears to be a configuration snippet instructing the page to load an XML file hosted on a github.io subdomain unrelated to the university. This is our technical interpretation of the URL. We have not opened that file and do not know what it contains.

We are not claiming that UCO published sexual content or that it was compromised. The URL shows something else. A viewer on the university website appears to accept external instructions through the address, and someone is using it to post a spam headline under a high-reputation domain.

Our reading: this is a well-known search engine optimization (SEO) spam technique. Educational and institutional websites carry a lot of authority with search engines, and anyone who gets one of them to "host" a link inherits that credibility. Generative AI makes it cheaper to produce this kind of bait at volume, and the headline, with its veneer of legality ("adults," "age verification"), aims to look legitimate.

There are two practical consequences. Institutions should audit the viewers and parameters that accept external data, and it is advisable to alert the service responsible. Readers should not open links of this kind: a familiar domain does not guarantee that the content is trustworthy.

The short term of AI also includes this: more noise and more fraud, produced at low cost. In the long run, defense will be equally automated, with filters that tell abuse apart from legitimate infrastructure. It is part of the price of the transition, not a reason to slow down the technology.

Since the source provides no facts about the advertised topic, there is nothing more to say without padding.