OnlyFake isn’t dead. It just rebranded. Meet MacDoc

When it comes to fake document generators, OnlyFake is a household name.

It caused a stir within the financial crime community, drew media coverage and built a reputation as the loudest service in a market full of quiet operators.

We've traced its history in depth:  the Blue Cat, the John Wick persona, the rebrand from "passport cloud" template farm to industrial-scale document generator, the years of forum activity behind it in our story last year.

Two months ago, things were supposed to change dramatically.

The U.S. Department of Justice and the FBI announced that Yurii Nazarenko,  a/k/a Yuriy Nazarenko, a/k/a Uriel Septimberus, a/k/a Tor Ford, a/k/a John Wick,  had been charged and pleaded guilty to operating OnlyFake.

According to DOJ, from 2021 through 2024 the service generated at least 10,000 fake digital IDs and brought in hundreds of thousands of dollars. Nazarenko was extradited from Romania. The main OnlyFake domain and its offshoots have been inactive since February 2026.

A clean takedown story. Founder charged, infrastructure dark and headline secured.

Except OnlyFake isn't dead.

It's been quietly rebranding for months and the new brand is already live, functional, and accepting customers as ”the best OnlyFake alternative.”

Meet MacDoc.

How we know MacDoc is the ”new OnlyFake”

The continuity of OnlyFake to MacDoc is documented in the operators' own forum trail.

In Chasing OnlyFake we already traced the OnlyFake platform back to Prostootrisovka (aka the "Blue Cat") the username active on 35+ Russian-language forums since 2020, weekly to daily, with thousands of posts per board.

Prostootrisovka is the operator-side voice of OnlyFake. John Wick, now identified by DOJ as Nazarenko, was the "technical mastermind" persona. Two digital avatars and characters, one operation.

And Prostootrisovka is still posting. The Cat didn't go anywhere.

What changed is the brand. Over the last several months, the same accounts on the same forums have:

• Switched their handles and avatars away from OnlyFake-adjacent identities,

   

• Pointed their threads at the new domains, and

   

• Gone back and edited old OnlyFake ads to reflect the rebrand, a quiet housekeeping pass across years of advertising material.

Picture: A comparison of a forum post originally published in 2023, with the current ”MacDoc” version on the left and the archived ”OnlyFake” version on the right

That last one matters. Copycats don't get to edit your old posts. Only the original poster does. The operators are demonstrating, in the most boring administrative way possible, that the accounts behind OnlyFake and the accounts behind MacDoc are the same accounts.

There's also a domain bread crumb we'd been sitting on. Throughout OnlyFake's history, the username and acronym "onetimes" appeared in operator communications, and onetimes.org has been tied to OnlyFake's admin for years.

The last Wayback capture, from September 2025, shows a site visually identical to OnlyFake and pointing to the same OnlyFake support Telegram channel.

The onetimes domain is now dead. The rebrand began roughly when it went quiet.

So we’ve got the same operators, same forum infrastructure, same Telegram channels, with Prostootrisovka running comms, and a methodical edit-and-redirect campaign across the existing advertising estate. Just a different logo.

Behold MacDoc.

A revamped, quite likely vibecoded and with a new sleek website design, the website introduces MacDoc as a ”document generator that can create custom documents in seconds”. All you need to do is to ”choose your country, document type, fill in the details and download various formats”.

The new homepage offers automatic generation of photos, signature generation, speed and low price. As before, MacDoc advertises several subscription plans incentivizing generation of a large number of documents, with the price-per-document dropping as much as tenfold.

But behind the shiny new homepage, everything seems virtually unchanged.

But something always changes both systematically and ad-hoc with template farms.

The website domains.

MacDoc domains, traffic and registration data

To our knowledge, 5 different “MacDoc” domains have been mentioned and advertised across Telegram and various web forums:

• macdoc.site

• macdoc.fans

• macdoc.io

• macdoc.co

• macdoc.pro

   

Two domains were registered in February 2026, and the other three during this May.

Hosting data points to Cloudflare servers in Canada and the United States.

The domain registration data are either redacted or point to already named mule entities such as Njalla Okta LLC, a company named as a known anonymous domain registration and hosting services provider originally founded by the co-founder of the famous piracy data silo the Pirate Bay.

At least 2 domains were also tested and confirmed as functional, meaning they do generate the final fake documents in various fromats.

Traffic-wise, only one of the domains reached 20k visits in its first few months of operating, with only one other in lower hundreds of visits and the other recording no traffic yet that would fall within the scope of third party traffic data providers.

Nearly all of it arrives as direct traffic from messaging platforms, exactly the pattern you see when a known operator funnels an existing customer base onto new URLs through Telegram. There's a small but visible tail from forums and search, which tells you the SEO and backlinking work is already underway.

The traffic will grow. There is no reason to assume otherwise.

How MacDoc works right now

The site, behind a sleek new homepage, is the OnlyFake generator with a fresh paint job.

Same UI. Same layout. Same pre-defined lists, dynamic fields, photo and signature upload, hologram option, metadata editor. Even some contact links still reference handles containing "onlyfake."

After logging in, you choose from a global catalog of passports covering 58 countries. Europe accounts for roughly 57% of the list. The catalog skews heavily toward developed and Western markets, with thin Africa and Middle East coverage. U.S. driver's licenses and IDs, perennial best-sellers in this market, are also available.

We tested the platform. It works, and it gives you high-quality documents in various formats. Not that we wouldn’t be able to detect these of course.

But the interesting part is what the backend does when you ask it to populate a document with "random" data.

The server doesn't just composite a face onto a template. It calculates correct document validity windows per country and revision year, generates legally-structured national identification numbers in the right format (Italy's codice fiscale, Malaysia's MyKad, Argentina's CUIT), handles Cyrillic-to-Latin transliteration for MRZ fields, and pulls from country-appropriate name databases, including dual-script Chinese names.

Final outputs are stored on AWS S3 and served via expiring download links. The watermark-removal function, the paid-tier feature that delivers the clean, usable document, is a separate server call.

And then there is the consent dialog. Every time a user clicks „generate”, a popup asks them to confirm they won't use the image illegally.

Such a logged acknowledgment is engineered to give the operators a plausible-deniability artifact and shift legal exposure onto the user at the moment of production, similarly to the previous ”novelty use” claims we’ve seen with other template farms.

Is MacDoc using genAI?

There's no API call to any known image generation service, or any LLM endpoint. The face photo pipeline calls an internal /get-photo endpoint that returns a stored "JohnWick.png" that  makes it pretty clear the photo pool is a curated static library, not generated on demand. Signatures are procedurally generated server-side using font rendering, not AI.

The background removal feature where users can strip the background from an uploaded photo before placing it on a document is described in the code as a server-side process.

Background removal at this quality level in 2024-2026 almost certainly uses a model like U2-Net or similar under the hood, but that would be a self-hosted library, not a GenAI service.

It's AI in the infrastructure sense, not the generative sense.

The tool's current architecture reflects how document fraud didn't need GenAI to become highly capable.

The sophistication here, from correct MRZ strings, jurisdiction-accurate ID numbers, transliteration engines to template versioning, is entirely rule-based and database-driven.

In other words, the tool works because someone mapped real document specifications over years, not because a model generated a convincing passport from scratch.

But the architecture is already shaped to accept the upgrade. One API call to a face synthesis service and the fingerprintability issue might disappear entirely.

And synthesis isn't even the cheap option necessarily.

Elsewhere in the same fake document ecosystem, there is a working market in real identities sold in bulk. Thousands per package, faces and matching selfies included, priced low enough that "generate a face" reads as a luxury workflow. 

That market, and what it costs to buy into it, is its own story. And we’ll cover that next time.

But the main message here is that the tooling reached near-professional quality before GenAI arrived. And when it does fully integrate, it won't be more of an upgrade than a revolution.

What the takedown actually took down

Yurii Nazarenko has been arrested and has pleaded guilty. The original OnlyFake domains are inactive. The DOJ press release is a real result and not nothing. It costs the operation a founder, sets a precedent, and demonstrates that even operators behind multi-year offshore infrastructure are extraditable.

It also did not take OnlyFake down. Or at least in the sense we would hope for.

The same operator on the same forums under a recognizable username trail set up a replacement brand on infrastructure registered months in advance, edited the legacy advertising estate to point at the new domains, and turned the lights on.

The capability moved with them.

This is the shape of the problem we've been describing across Doc Juicer, VerifTools, and now MacDoc.

Template farms are not domains. They are not even websites.

They are operator networks running on top of global internet infrastructure that was built to make hosting cheap, registration anonymous, jurisdictions optional, and migration a matter of clicks.

An arrest removes a person.

A domain seizure removes a URL.

Neither removes the network, the capability, or the customer base for that matter.

Template farms are unkillable in the only sense that matters operationally: the time it takes to put one down is much longer than the time it takes to stand the next one up.

OnlyFake is dead. Long live MacDoc.

Until the next rebrand.

---

Want to learn more about template farms and serial fraud?

Sign up for the Threat Radar.