What is Doxing?

In 2025, the internet is rife with tension, heated disagreements, and division. Doxing (or doxxing) is a common weapon used to escalate online disputes into real-world threats by publishing personal details like home addresses and phone numbers.

In this guide, we explain how doxing works, who it targets, and what methods attackers use. Most importantly, we provide practical advice on protecting yourself from doxing and what steps to take if you become a victim.

Doxing refers to publishing private information about a person online without their consent. This could be a home address, phone number, family details (e.g., child’s school), Social Security Number, financial records, or other sensitive information. The act is usually intended to incite harassment, bullying, intimidation, shaming, or even physical harm.

Doxing has its origins in the hacker subculture of the 1990s, when uncovering and exposing a rival hacker’s real-world identity was a common form of revenge or one-upmanship. Unmasking someone was known as “dropping docs” (documents), shortened to “doxing.”

Doxing has since evolved into a more widespread and dangerous form of harassment. Social media and today’s increased online visibility have only fuelled the practice.

Modern doxing is frequently weaponized against people with opposing viewpoints. It plays a major role in “cancel culture” and culture wars. It’s also used by trolls and online bullies, disgruntled ex-partners, vengeful former colleagues, or someone with online “beef” as a form of revenge or harassment.

How Doxing Works?

While doxers often have hacking skills, anyone with online proficiency, time, and motivation can collate enough data to dox you. Perpetrators also buy data on the dark web or from shady intermediaries.

Let’s break down the most common tactics and tools used by doxers to obtain the information they exploit.

Phishing Attacks And Email Infiltration

Phishing attacks and email infiltration are common entry points for doxing since email is one of the most prevalent forms of communication, especially in business settings.

Phishing involves deceiving a victim into clicking a malicious link or entering credentials on a fake login page. The goal is to steal information such as usernames, passwords, and other sensitive details.

With email infiltration, attackers break into a victim’s inbox and search the contents for personal data such as addresses, IDs, or financial information. Infiltrators use stolen credentials or exploit weak security to gain this unauthorized access.

Stalking Public Social Media Profiles

Stalking public social media profiles is a widely employed doxing technique.

If you’re active on a social media platform like Facebook, Instagram, X, or TikTok, chances are there’s plenty of information about you readily available. Think photos with identifiable landmarks, check-in locations, and connections to friends and family.

By piecing together information from various profiles, doxers can map out your real-world identity, location, and daily routines.

WHOIS Lookups On Domain Names

WHOIS is a publicly accessible database that stores contact details for registered domain names. While intended for transparency and administrative purposes, WHOIS is often exploited to dox “enemies”.

Bad actors use WHOIS to find personal details linked to a website or domain. Getting this information becomes much easier when domain owners fail to use basic privacy protection services.

Scraping Government And Public Databases

State and other government databases contain extensive personal and business information, like business licenses, tax details, DMV records, social security details, marriage licenses, court and legal records, and voter registration rolls.

Unsurprisingly, doxers pull data from these databases to publish and cause distress to their targets.

Tracking Usernames Across Platforms

If you use identical usernames across multiple online accounts and services, you share this habit with millions of other people. While this approach makes sense because it’s simple and convenient, it also makes the job easier for anyone who wants to dox and harass you.

IP Address Tracking And ISP Impersonation

Your Internet Protocol (IP) address is your unique online identifier. By tracking IP addresses, doxers can estimate your physical location, sometimes down to your neighbourhood. With this information, they may physically track you or launch cyberattacks such as Denial of Service (DoS) operations.

A doxer who knows your IP may approach your internet service provider (ISP) pretending to be you. This impersonation allows them to gain additional personal information to pile on the abuse.

Reverse Mobile Phone Lookup Tools

Your mobile phone reveals a surprising amount of information about you. Doxers can exploit this information source simply by knowing your phone number.

Using reverse lookup tools like Whitepages, Spokeo, and Truecaller, they retrieve details such as your name, address, and associated online profiles.

Packet Sniffing On Unsecured Networks

Digital data is transmitted across the internet in small units called “packets”. Packet sniffing is where hackers/doxers intercept internet data to look for personal information.

They accomplish this by exploiting unsecured public networks or gaining access to a router or network with poor security protections.

Purchasing From Data Brokers Or Dark Web Markets

Purchasing personal information from data brokers or dark web markets is another common doxing tactic. These sources sell private data and information linked to personal accounts, which doxers use to initiate exposure or harassment.

What Information Do Doxers Look For?

Doxers hunt for a broad spectrum of sensitive information, mainly focusing on the following:

Phone numbers: Doxers target phone numbers to harass their targets directly through unwanted calls and texts, or reveal sensitive information about them via reverse lookup tools. Phone numbers are also exploited to commit identity theft through attacks like SIM swapping.

Home/work address: This is the most direct threat. It often leads to physical harassment, stalking, and even “swatting” (sending a SWAT team to a location with a false report of a crime). A doxxed home or work address brings online conflicts directly to the victims’ real front door.

Social Security Numbers (SSNs): SSNs are highly sought after by doxers. As a core part of our ID, exposed SSNs are used for identity theft, financial fraud, or to access an individual’s government accounts.

Account logins: Accessing account logins allows for exploitation, like data theft and online impersonation. Targets are often locked out of their accounts. Besides effectively seizing control of their personal/professional life, doxers may also spread false or misleading statements about the victim.

Personal photos or videos: We have seen many cases where personal photos and videos have been used for public shaming and blackmail.

Credit card and bank info: Exposing this data is a direct path to financial fraud. It allows malicious actors to make unauthorized purchases, drain bank accounts, or steal the victim’s financial identity.

Security question clues (e.g., pet names, maiden names, schools): These seemingly innocent details often provide clues to unlock sensitive, personal information. Once revealed, they are leveraged to bypass security controls and reset passwords.

Family member details. Sensitive family information is often exploited to gather more data for identity theft or even to threaten loved ones.

Online activity and opinions: Social media posts, comments, or affiliations can be distorted and weaponized to damage reputations or incite harassment in the real world (typically coupled with details like phone numbers or family information).

How To Protect Yourself From Doxing?

In our noisy online age, virtually anyone on the internet can get doxed. To protect yourself, follow our top 10 recommendations for mitigating doxing risks.

Lock down your social media accounts

Weakly secured social media accounts are easy targets for hackers and doxers. To avoid becoming a victim, be vigilant about protecting your socials. Limit what strangers can see by setting profiles to private and restricting friend requests.

Avoid posting sensitive details such as your home address, phone number, work address, and children’s details.

Know that even if you use a pseudonym, doxers can crack your identity by cross-checking one social media account with another, especially if you use it to interact with friends and associates.

Hide Domain Registration Information (WHOIS Privacy)

If you own a domain name, use WHOIS privacy protection to conceal your domain registration information.

This prevents attackers from seeing details tied to your domain, often including your name, email address, phone number, and physical address.

Guard Against Phishing

Bad actors are launching phishing attacks every minute of every day. These operations are typically automated and distributed widely at scale. According to CISA estimates, more than 90% of successful cyberattacks start with a phishing email.

To protect yourself against seemingly legitimate messages and pages crafted to deceive you:

Always double-check the sender’s email address.
If it’s a link you don’t recognize, think carefully before you click.
Trust your instincts, and delete unusual requests from unknown sources.
Never share login details via email.
Hover over links before clicking. This allows you to check for red flags such as misspelled domains (e.g., “paypa1.com” instead of “paypal.com“).
Educate your family and team members about the dangers of phishing and how to identify these malicious approaches.

Create Separate Email Accounts

Regarding email security, a good practice is to use different accounts for different purposes. For example:

Your personal account (not publicly listed) – reserved for private communications with friends, family, and trusted contacts.
A dedicated “spam” account – used for online sign-up to apps, accounts, services, and promotions (it may appear publicly in some situations, but try to limit exposure).
Your work email – publicly listed or available within your professional network for business communications.

This compartmentalization reduces the danger of a single compromise exposing all your accounts and activities.

Employ Strong Privacy And Security Protocols

Be vigilant about your privacy and password security:

Enable two-factor authentication (2FA) on all important accounts. 2FA adds an extra security step by requiring your password plus a second factor, e.g., a one-time code or biometric data. Multi-factor authentication adds another security layer.
Use strong, unique passwords (a combination of uppercase and lowercase letters, plus numbers and symbols).
Avoid using the same password for multiple accounts.
Change passwords periodically.
Review your privacy settings regularly to limit unnecessary data exposure.
Invest in antivirus and malware detection software, and keep this protection up-to-date.

Manage App Permissions Carefully

When taking an online quiz or signing up for a third-party app, you may be prompted to allow it access to your social media accounts. This can be a serious privacy risk. In the infamous Cambridge Analytica scandal, a quiz app was used to harvest not only user data but also their friends’ private details.

The risks of a maliciously created app are obvious. Even if the app is legitimate, its security may be weak, allowing doxers to steal your information.

This compartmentalization reduces the danger of a single compromise exposing all your accounts and activities.

Use A Virtual Private Network (VPN)

A secure VPN helps defend you against doxing by masking your unique IP address. We’ve mentioned that your IP is a key piece of information doxers use to hone in on your real-world location.

By routing your internet traffic through a remote server, a VPN hides your true IP address behind the server’s. This makes it much harder for anyone to trace your online activity back to your personal identity and location.

Research to make sure you use a reliable VPN provider with a strong privacy policy. Untrustworthy services have been known to expose users’ data.

Limit Your Use Of Public Wi-Fi

Be cautious when using public Wi-Fi, as these networks are often unsecured. Because the traffic is typically unencrypted, bad actors harvest personal information, including passwords and login details.

To reduce your risk of doxing, always use a virtual private network to encrypt your connection when on public Wi-Fi. If you don’t have a VPN, turn off public network sharing functionality and other sharing features on your device before connecting.

Remove Yourself From Data Broker Sites

There are an estimated 4,000 data brokering companies worldwide. This $200 billion industry, largely invisible to most people, collects and sells your personal information (shopping habits, search history, location data, and more) to advertisers and businesses.

The industry is only lightly regulated, meaning your data may easily fall into the wrong hands, potentially leading to doxing.

It’s technically possible to remove your data from brokers. However, given the volumes involved, it’s a difficult, time-consuming project.

Services like Incogni, DeleteMe, and OneRep will handle the process systematically on your behalf. You sign up, authorize them to act for you, and they send legal requests to remove your data under privacy laws.

Don’t Overshare In Online Communities

Be careful about how much information you share in online communities. Even casual mentions of your city, workplace, or habits can be pieced together and used to target you.

A good rule of thumb is to assume that everything you say in communities like Discord, Reddit, Slack, gaming forums, and Facebook Groups could potentially become public. Protect your privacy by limiting identifying details in these spaces.

How Easy Is It For Someone To Dox You?

It’s possible to check how easy it is for someone to dox you. The best way is to run a self-doxing audit, which is essentially an investigation to find information about yourself online, the way a doxxer would.

Here’s a helpful audit checklist:

Search your full name on major search engines and see what comes up.
Look up your phone number and email address to check if they appear on public sites, forums, or business listings.
Check social media profiles (including old or inactive accounts) for personal details that are visible to the public.
Use people-search sites like Spokeo, Whitepages, or Truecaller to find out if they list your address, relatives, or other sensitive data.
Perform a reverse image search with your profile photos on Google Images or TinEye to find other sites or accounts linked to you.
Check breach databases like HaveIBeenPwned to see if your email or passwords have been exposed.

The goal is to establish how much information is publicly available and how easily it can be linked to your real identity. The more that’s out there, the more vulnerable you are to doxing.

If you’re worried about your business being doxxed, Acrisure’s cybersecurity expertise protects organizations with strong security measures to minimize online threats, including doxing.

Please reach out to discuss improving your company’s online security.

What To Do If You’ve Been Doxed?

Here’s a quick response checklist to follow if you’re ever doxxed:

Stay calm – Panic can cause you to overlook important steps or make poor decisions that worsen your situation.
Record evidence – Screenshot posts, save URLs, and note dates/times.
Report it – Use platform abuse/privacy tools to request the removal of your doxxed info. Contact moderators and file formal complaints through official channels.
Involve law enforcement – Especially if threats or harassment are involved.
Lock down accounts – Change passwords and enable 2FA promptly.
Safeguard your home – Alert police/security if your address is exposed.
Monitor for more leaks – Use breach-check tools and Google Alerts to catch new instances of your information appearing online.
Get support – Lean on friends and family, or seek professional help for support.
Seek legal advice – Understand your rights when dealing with threats and harassment.