What is doxxing?
Definition
Doxxing is collecting someone's personal details, such as their home address, phone number or workplace, and publishing them online to harass, threaten or humiliate them.
- Category
- Privacy
- Also called
- doxing, dropping dox
- Last updated
The name comes from "dropping docs", old hacker slang for exposing the documents behind someone's online handle. Today it means any public release of a person's private details that's meant to hurt them. The US Department of Homeland Security describes it as gathering an individual's personally identifiable information and releasing it publicly for malicious purposes, such as stalking, identity theft or targeted harassment.
How doxxers find your details
Most doxxing needs no hacking at all. DHS lists the usual sources: social media posts, property and court records, voter registration lists, wedding announcements and obituaries, newsletters, forums and blogs. People-search sites do the hardest part for them, because they already join those records into one profile with your address, phone number, relatives and past addresses. CISA notes that doxxers also use data from breaches.
A typical case: someone gets into an argument online, the other side finds the person's real name from an old profile, looks it up on a people-search site, and posts the home address in a thread with a call to "pay them a visit".
Why it matters
Once an address and phone number are public, the harm can move offline: stalking, threats at the door, unwanted deliveries or a fake emergency call to police (swatting). The same details help with identity theft. It can happen to anyone whose details are easy to find, and the easier your address is to look up, the less effort it takes.
Doxxing vs. related terms
- Swatting is a fake emergency report meant to send armed police to someone's home. It often follows doxxing, because the caller needs the address first.
- A data breach leaks data from a company's systems. Doxxing is a person deliberately publishing details about a specific target, sometimes using breached data.
How to protect yourself
- 1
Remove your listings from people-search sites
DHS names BeenVerified, FastPeopleSearch, Intelius, Spokeo, TruthFinder and Whitepages as places to start. Each has its own opt-out, and listings tend to come back, so check again every few months. Serus finds where your address and phone number are listed and removes them for you.
- 2
Strip personal details from your profiles
Take your address, birthday, phone number and workplace off social media, and set accounts to private. Guides: make Facebook private, make Instagram private, make your LinkedIn profile private.
- 3
Get your contact details out of Google results
Google's Results about you tool lets you request removal of search results that show your phone number, home address or email.
- 4
Limit location sharing
Turn off location services for apps that don't need them and avoid posting photos that show your home, street or car plate in real time.
- 5
Lock your accounts
Use a different strong password for every account and turn on two-step verification, so a doxxer can't take over your email or social profiles with leaked passwords.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is doxxing illegal?
Publishing information that's already public isn't always a crime on its own, but doxxing that comes with threats, stalking or harassment can be, and some states have laws aimed at it directly. The rules depend on where you live and what was done, so talk to local law enforcement or a lawyer about a specific case.
What should I do if I've been doxxed?
DHS recommends three things: save evidence (screenshots, emails, voicemails, texts), ask the platform or website to take the content down under its rules, and report threats to your safety to local police. If a crime happened online, you can also file a complaint with the FBI at ic3.gov.
Can I stop people-search sites from listing me?
Yes. Most of them have an opt-out process, though it differs per site and listings often reappear when the site refreshes its data. Our [data broker guides](https://www.serus.ai/data-brokers/) walk through each one.
Is it doxing or doxxing?
Both spellings are used. DHS and CISA write "doxing" with one x; "doxxing" is the spelling most people search for.
Sources
Something wrong or out of date? Tell us and we'll re-check it.