Onlyfake rebrands again: meet Verif2Go

Within the fake document ecosystem, things can change fast.

Four months ago, we reported that OnlyFake, the infamous fake document generator, had rebranded itself as “MacDoc" after the FBI announced it arrested one of the service’s original operators, Yurii Nazarenko.

New logo, new visual identity, new website domains, but the same generator engine and the same document catalog.

At first, the pivot seemed successful. The new MacDoc domain recouped a lot of the OnlyFake traffic and had been picking up speed in the last few months, but that might have quickly turned sour. And we’d like to think we might have had a hand in it thanks to our own reporting on the rebrand.

Why?

Because over the last 2 months, OnlyFake (or MacDoc) decided to go through yet another rebrand, one that now seems fully completed, and just a few months later after our report on the rebrand from OnlyFake to MacDoc.

Let’s unravel the “death” of MacDoc and what comes next for the original OnlyFake operators.

The new “kid on the block?” Meet Verif2Go (aka V2Go).

The demise of MacDoc

Everything seemed to be chugging along just fine for MacDoc, recouping majority of the traffic of the original OnlyFake domain (onlyfake.org).

With 5 different domains active, the “new OnlyFake” aka “the OnlyFake alternative” was getting over 50k visits and 10k unique visitors in August alone according to traffic data from Semrush. This is roughly on par with the average traffic of the original OnlyFake domain.

Figure: Web traffic data on the published domains suggest decent traffic since the MacDoc launch, with over 50k visits for one of the domains in August alone

This level of traffic is also solid and above average within more than 200+ template farm websites we already track, implying a clear demand for fake document generation.

Then came September, and none of the MacDoc domains can now be accessed.

Figure: None of the originally listed MacDoc can now be accessed

When looking at the Internet Archive, there’s only a historical capture of one MacDoc domain (macdoc.io), which at least gives us a window into what the MacDoc sites looked like between just a few months ago when we reported our last piece and August when the domains were still accessible.

Figure: One of the MacDoc domains has been captured and archived by the Wayback Machine, providing a look into the short life of the MacDoc brand

But why would the MacDoc admins disrupt what seemed to be working well after the original OnlyFake brand got exposed and its founder arrested by the FBI?

Chances are that this had something to do with our own reporting.

To our knowledge, our article published at the end of May was the first one to shine a light on MacDoc as the new OnlyFake and dissect the rebrand. As such, this encroached upon the generator’s ranking in search results, which have for months now included our article among the top URLs for that query.

Figure: Our expose on MacDoc clearly impacted the template farm’s SEO visibility, theoretically contributing to the rebrand to Verif2Go

To be clear, organic traffic of the MacDoc website made up less than 1% of the overall traffic, with over 97% of it being direct, so it’s not like people were accessing the MacDoc generator primarily via search engines.

But even at that split, the search visibility should not be discarded as irrelevant because both existing and aspiring fraudsters might google you at some point. As we‘ve shown repeatedly, template farmers do invest in SEO and optimize for it so they clearly do care.

And it’s quite self-explanatory that MacDoc operators (or any other template farmers, for that matter) do not like that an analysis highlighting them as a threat actor pops up when you search for them.

Ultimately and regardless of the reason behind it, the original MacDoc admins made the call to rebrand again during this summer, less than 3 months since our article on the MacDoc rebrand.

Meet Verif2Go (aka “V2Go”).

The rebrand to Verif2Go

As with MacDoc, the rebrand starts with domain purchases, then re-directing traffic from the old ones, and ultimately turning those off once the new websites are publicly announced and fully set up.

The original announcement about the new domains was made on Verif2go’s Telegram channel at the start of September: seven new domains, with most created and registered in August:

• verif2go.org

• verif2go.us

• v2go.org

• verif2go.cc

• verif2go.com

• verif2go.me

• verif2go.net
  

Figure: New Verif2Go domains were officially announced at the start of September

Another Telegram account associated with Verif2Go even lists MacDoc and Verif2Go within the same chat description.

Figure: A support account for MacDoc directly links to the rebrand to Verif2Go

Domain registration data on all the new domains are redacted and the opening of the domains was handled by several registrars including the German domain providers 1API GmbH and Key-Systems GmbH. Servers are located in Canada, with Cloudflare managing the hosting.

No third-party traffic data yet, the domains are too young for that, but associated Telegram channels have thousands of subscribers and the wider fraud community forums get tens of thousands of visitors as well.

But how could we credibly connect Verif2Go to MacDoc and ultimately the original OnlyFake operators?

Searching for “Verif2Go” across our pool of relevant web forums, some of the results pointed us to, once again, re-branding activity by original forum accounts of Prostootrisovka (aka “the Cat”, the other main character behind OnlyFake other than Nazarenko aka John Wick).

Case in point: one surfaced thread started in December 2025 (i.e. before MacDoc or Verif2Go even existed) was originally meant for OnlyFake to “test OnlyFake features for free” but now shows Verif2Go as the author.

Figure: Old forum thread from December 2025 is now attributed to “Verif2Go” as an author

In the last few weeks, Verif2Go also started posting new forum threads promoting its generator, further establishing the new brand and even adding some new (quite humorous) visuals (like an animated Mona Lisa) advertising the different functionalities of the generator.

Figure: Template farmers love to stand out with their advertising, and Verif2Go changed the colour scheme and added new animations in this forum ad for its fake document generator

Forums aside, there’s also remnants of MacDoc scattered throughout the V2GO websites themselves, from cookie files named “macdoc” to backend folders like “macdoc assets.” In short, plenty of circumstantial evidence to connect the two brands together.

But the crucial part of retracing back to previous iterations of the OnlyFake document service is the continuing account histories and our successful account logins with our original OnlyFake credentials.

Figure: Verif2Go account details show our purchase of the original OnlyFake subscription back in 2024, long before either MacDoc or Verif2Go domains even existed

Without direct access to original internal databases of OnlyFake, this would not be possible, and it’s the most important direct piece of evidence untangling the OnlyFake-MacDoc-Verif2Go thread.

With the connection clearly established, let’s look at how Verif2Go looks right now.

Verif2Go right now

While the website visuals are obviously starkly different (new logo, new colours), most of the website is virtually the same on the content side.

One notable change on the homepage? The website introduces localizations for English, Russian, Spanish and Chinese, showing that the operators want to cater to a more global audience.

Figure: New colours, new logo, and more language localizations
have been introduced with the rebrand to Verif2Go

Even the pricing structure is essentially identical, though the description of different packages is now slightly more detailed.

Figure: Pricing structure is essential identical to the one previously advertised by MacDoc

The generator engine seems largely replicated, with no significant tweaks or changes to, admittedly, the quite short-lived MacDoc version.

For years now, the OnlyFake generator has been known for outstanding file quality and high resolution. This has carried over to the latest iteration as well.

Passports, Driver licenses and IDs in “scan” or “photo quality. SSN, barcode, signature and face generators that are not as sophisticated or AI-driven as might look at first sight (we’ve covered the AI aspect of the generator extensively in our previous exposes on OnlyFake).

Figure: Verif2Go’s generator very much resembles previous OnlyFake and MacDoc iterations, with several smaller tweaks. It even retains the nostalgic call back to "John Wick" aka Nazarenko in its document image preview/example

Interestingly, Verif2Go decided to add a new set of backgrounds for the document images, showing that the developers do continue to slightly tweak and improve the tool. They also brought back the “add your own background” feature.

Figure: Verif2Go has added some new features compared to the MacDoc iteration,
including new and custom document image backgrounds or an AI passport/ID photo generation, previously relying only on a static catalog of faces labelled as "photodrops"

The other component worth highlighting is an EXIF data manipulation feature that allows for changing the metadata of the document picture itself, including device type, GPS coordinates and date and time.

Figure: The Verif2Go generator now allows to manipulate the document image EXIF data

Once again, the generator advertises a batch generation feature catering to fraudsters in need of tens to hundreds of IDs. We’ve pointed out previously how that often affects the pricing itself, with a previous generator iteration under the OnlyFake brand significantly lowering the price per document for bulk customers.

Weirdly enough, the Verif2Go batch generator does not seem to have an “import” functionality that would allow for uploading a list of PII via a spreadsheet, for example. More importantly, the batch generation crashed repeatedly when testing it and never provided any actual documents. Verif2Go might have it on the website just for advertising purposes rather than having a real, usable feature.

In that sense, advertising versus reality is actually nothing new for OnlyFake (aka MacDoc aka V2GO), as we‘ve analyzed it previously with respect to the generator’s proclaimed use of AI.

Implications of a template farm (repeated) rebrand

Witnessing a second OnlyFake rebrand in less than a year, the latest pivot to Verif2Go points to three important considerations:

• Reporting on threat actors and calling them out by their real name and domains publicly impacts their SEO and reputation, and can theoretically trigger a response.
  
  
• The rebrand itself is likely not that costly or time-consuming, retaining the reputation and goodwill of the original brand potentially is. How many rebrands can you go through before the market loses track? One thing we’ve been seeing is that trust and recommendations seem to go a long way in the fake document ecosystem, and frequent rebrands might disrupt that.
  
  
• Cataloging a threat actor once or twice a year simply is not enough. As infrastructure might shift often and repeatedly, continuous monitoring of threat actors such as template farms is paramount.
  

As we have done with Verif Tools, Fakedocshop, OnlyFake, MacDoc and now Verif2Go, naming a threat actor might haver value. With both Fakedocshop and MacDoc, we have now seen two instances of template farm websites changing their brand name and domains shortly after reporting on them.

We need to work further to prperly substantiate this hypothesis, but it seems that the potential risks of directly linking to a threat actor are outweighed by the potential for disruption our reporting might bring to template farmers, and by notifying the fraud prevention space on the latest shifts in the document fraud ecosystem.

In other words, while we already have been making template farmers’ lives harder by detecting their fake documents using Resistant Documents, we have now entered a phase of adding to it by unscrupulously calling them out publicly.

And we’ll keep doing so even more.

Let’s see what now happens with Verif2Go.

Enjoyed this content? Sign up for our "Threat Radar" newsletter using the form on your left!