On a Tuesday in October 2022, a journalist covering communal violence in Manipur opened Twitter. Pinned in a thread with sixty thousand impressions was her home address, the one she hadn’t published anywhere. Her phone number followed. Then the names of her children’s school. The replies were not ambiguous about intent.
She’d done nothing wrong. She’d published accurate reporting. Someone decided that was sufficient reason to weaponize every piece of information they could find about her. They posted it where tens of thousands of people could act on it.
That’s doxxing. Not a fringe phenomenon, not something that only happens to celebrities. A real and documented tactic used against journalists, activists, women who express opinions online, and anyone who attracts the wrong kind of attention.
Being doxxed right now? If your home address is public and the threats feel direct, treat it as a physical-safety situation. Screenshot everything first, then report. For support in India, call iCall at 9152987821 or the National Commission for Women helpline at 7827170170. Full steps are in “If you’re being doxxed right now” below.
The short answer: Doxxing is publishing your private details so a mob can find you. Doxxers use people-search sites, social media, WHOIS records, voter rolls, and property records. Nearly all of this is public and legal to collect. You can’t become invisible, but you can raise the cost of finding you: search yourself, remove broker listings, lock down social profiles, use WHOIS privacy, and strip photo metadata.
Jump to: What doxxing is · How doxxers find you · Who gets doxxed · Protect yourself now · If you’re being doxxed · What platforms owe you
What doxxing actually is
Doxxing is the deliberate publication of someone’s private information to enable a mob to harass, threaten, or physically harm them. That information includes home address, phone number, employer, family members’ names, vehicle registration, and daily schedule. The name comes from “dox,” a slang abbreviation of documents.
The mechanics matter. A common defense doxxers offer is that all the information they published was technically public. This is usually true. Your name is public. Your approximate neighborhood might be public. Your employer might be on LinkedIn. But aggregating, connecting, and broadcasting that information to an audience motivated to harm you is what turns scattered data into a weapon. The harm is in the targeting, not any single data point.
Doxxing is not a new tactic, but the internet has industrialized it. In 2014, Gamergate demonstrated what coordinated doxxing could do at scale. Female game developers and critics, among them Zoe Quinn, Brianna Wu, and Anita Sarkeesian, had their home addresses, phone numbers, and family members’ details posted across 4chan, Reddit, and Twitter. Death threats followed. Several were forced to leave their homes. The campaign lasted months and destroyed careers. It was also, in retrospect, a rehearsal. The tactics that emerged from Gamergate were refined and applied in every subsequent coordinated harassment campaign.
In India, doxxing has a specific and documented communal dimension.
The Bulli Bai and Sulli Deals cases
In July 2021, a GitHub repository called “Sulli Deals” appeared. It listed photographs of Muslim women, with language framing them as objects for “auction.” These were real women, real names, real photos scraped from social media. The repository did not host the women’s addresses directly. But it identified them by name and photo to an audience that knew how to find the rest. GitHub took the repository down after complaints. By then, the damage was done.
In January 2022, a new repository called “Bulli Bai” appeared on GitHub with the same structure and the same targets. This time, the response was faster. Mumbai Police arrested the app’s developer, a 21-year-old from Uttarakhand, within days. Delhi Police made additional arrests. The individuals arrested were young — in their early twenties — which did not make the targeting any less coordinated or the harm any less real.
Both cases illustrate something specific about doxxing in the Indian context: that it can be organized around religious and communal identity in ways that carry threat registers beyond ordinary harassment. For Muslim women who were listed, the targeting communicated not just “we found your information” but “we consider you a legitimate target for communal violence.” The doxxing was also a threat assessment.
GitHub’s response — removal after the fact — was the standard platform response to doxxing. Reactive, not preventive. The repositories were live long enough to be screenshot, shared, and archived.
How doxxers find information
Understanding the attack surface is the first step to reducing it. Doxxers are not sophisticated hackers in most cases. They are patient researchers using tools that anyone can access.
People-search sites are the starting point. Sites like JustDial, Whitepages, BeenVerified, and Pipl aggregate publicly available records into searchable profiles. That includes phone directories, business registrations, property filings, and court records. In India, JustDial indexes business phone numbers that often belong to the individual business owner. Whitepages maintains Indian records. These sites exist to sell data access. They do not distinguish between legitimate users and people building harassment dossiers.
Social media OSINT — open-source intelligence gathering — is more powerful than most people assume. Username correlation is the basic technique. If you use the same handle on Twitter, Reddit, Instagram, and a gaming forum, someone can cross-reference everything you’ve posted across all four. Location can be extracted from photo EXIF data: the metadata that cameras and smartphones embed in images, which often includes GPS coordinates. Even without EXIF data, photos reveal information: a distinctive building in the background, a local landmark, a bus route number on a bus stop sign. Identifying a neighborhood from a selfie background is not difficult for someone who knows the area.
Domain WHOIS records have historically been one of the most significant leak vectors. When someone registers a website without purchasing WHOIS privacy protection, their name, address, phone number, and email are publicly indexed in the WHOIS database. These records can be years old and still live — older registrations from before WHOIS privacy became standard practice remain accessible through historical WHOIS tools.
LinkedIn is an open professional directory. Your employer, your job title, your professional connections, your career history — all published voluntarily and indexed publicly by default. For doxxers, LinkedIn answers the question “where do they work and who do they work with” in seconds.
Voter rolls in India are a significant and underappreciated data source. The Electoral Roll — the official list of registered voters — is publicly accessible and contains name, address, and voter ID number. The Election Commission of India publishes electoral rolls online. Someone with your name and approximate location can often find your registered address from public electoral data.
Property records are public record in India. Land registry details, including ownership names and addresses, are accessible through state registration departments. If you own property registered in your name, that information is public.
None of these require technical skill. They require time, motivation, and the knowledge that these sources exist. All of which doxxers have.
Who gets doxxed
The population of doxxing targets is not random. Some categories recur consistently.
Journalists — particularly those covering organized crime, political corruption, or communal issues — are targets because their work creates enemies with resources and motivation. A journalist who exposes a politician’s land dealings or documents a mob’s activities has given that party a direct reason to silence them. Doxxing is cheaper than litigation and more immediately effective at changing behavior.
Women who express opinions online are a disproportionate target. This is not speculation — it is one of the most documented patterns in harassment research. A woman who says something about politics, gaming, religion, film, or virtually any subject in a public forum with sufficient reach becomes a potential target. The threshold for triggering a doxxing campaign can be very low.
People involved in public controversies — even momentary ones, even minor ones — discover that a viral moment creates a harassment window. Consider someone filmed in a confrontation, or whose tweet gets screenshotted and shared, or whose comment in a local Facebook group gets picked up by a larger account. Any of these can produce a brief burst of hostile attention. That is all someone with doxxing skills and malicious intent needs.
Activists and protesters who participate in public demonstrations face targeted doxxing from opponents of their cause. Farmers’ protest supporters, anti-CAA protesters, environmental activists — all have faced documented doxxing campaigns from organized opposition groups.
And, bluntly: anyone who wins an online argument with someone unstable enough to retaliate. The asymmetry of doxxing is part of what makes it effective as intimidation. You don’t need to be prominent to be targeted. You need to have made one person angry enough to spend two hours researching you.
Pre-emptive protection — what you can do now
The goal of protective measures is not invisibility, which is unrealistic for most people. The goal is to raise the cost of finding your information high enough that you fall below the threshold of effort a harasser is willing to invest.
Start by searching yourself. Open Google and search your full name in quotes, your name plus city, your name plus phone number. Search your username across platforms. Check your name on JustDial. Check Whitepages. What’s already indexed tells you where your current exposure is.
Remove or suppress data broker listings. JustDial has a contact form for removing listings. Whitepages has a privacy request process. The removals don’t always stick, and they’re not instantaneous, but they reduce the depth of what an automated search returns. For a step-by-step removal guide, see our post on removing your data from Indian data brokers.
Use WHOIS privacy on every domain you register. If you register a domain name — for a personal site, a side project, a small business — pay for WHOIS privacy. It costs under ₹500 per year with most registrars and removes your name and address from the public WHOIS database entirely. Check your existing domain registrations today. If WHOIS privacy isn’t enabled, enable it.
Audit your social media profiles. Remove your phone number from every platform that has it — Twitter/X, Facebook, Instagram, WhatsApp’s linked accounts. Remove your home city or make it vague (state level rather than city). Remove your workplace from public view if you can. On Facebook specifically, check who can see your friends list — a full friends list is a map of who can be targeted to reach you.
Use a PO box or virtual address for anything that requires a public-facing physical address. Business registrations, domain registrations, freelance work — if you need to provide a mailing address to a third party or for a public record, use an address that isn’t your home. India Post offers PO boxes. Several private services offer virtual address and mail forwarding.
Maintain separate email addresses for public and personal activity. Your public-facing email is the one attached to your Twitter account, your bylines, and your public profiles. It should not be the same address tied to your bank account, your phone number, and your close personal contacts. Keeping them separate limits the blast radius of any single exposure.
Strip EXIF data from photos before sharing. On Windows, right-click any image and navigate to Properties > Details > Remove Properties and Personal Information. On Linux and macOS, ExifTool is a free command-line utility that removes metadata from individual images or entire directories in a single command. No technical background required — exiftool -all= filename.jpg removes all metadata from a file. Do this before posting any photo publicly, particularly anything taken on a smartphone in a location you’d rather not disclose.
Use inconsistent usernames across platforms. If you use the same handle on Twitter, Reddit, LinkedIn, gaming forums, and a cooking blog, you’ve made cross-platform correlation trivially easy. Your handle on a platform where you discuss personal subjects should not be searchable back to your professional identity. The inconvenience is minor. The protection is meaningful.
If you’re being doxxed right now
The first instinct when discovering a doxxing is to report everything immediately and hope for fast deletion. This is the wrong sequence.
Screenshot everything first. Reports and takedowns sometimes trigger deletion before you’ve documented what was posted. A screenshot of the original post, the timestamp, the username of the poster, and the URL is evidence you may need for a police complaint, a platform escalation, or a legal action. Document before you report.
Report to the platform. Twitter/X, Facebook, Reddit, and GitHub all maintain explicit policies against doxxing. Twitter/X’s rules prohibit “publishing or posting other people’s private information without their express authorization and permission.” Reddit bans doxxing site-wide, though enforcement quality varies enormously by subreddit and moderator. GitHub has a documented process for removing repositories that doxx individuals — the Bulli Bai takedown came through this process. Use the platform’s official report mechanism and be specific: name the policy being violated, link the content, and include screenshots in your report.
File an FIR with cyber police. Doxxing as a standalone named offense does not exist in Indian statute — but it can be prosecuted under multiple existing provisions. Section 66 of the IT Act covers computer-related offenses. Section 66C covers identity theft. Section 66D covers cheating by personation using communication devices. Section 354D of the IPC covers stalking, which includes online monitoring and contact for the purpose of fostering personal interaction. File an FIR at your nearest cyber crime police station. You can also file online at cybercrime.gov.in. Include screenshots, URLs, and timestamps.
Contact CERT-In. India’s Computer Emergency Response Team maintains a complaint mechanism for cyber incidents at incidents@cert-in.org.in. For cases involving coordinated harassment with a cyber component, a CERT-In complaint creates an official record and can trigger escalation.
Contact a domestic violence helpline if physical safety is at risk. If the doxxing includes your home address and the threats are direct, treat it as a physical safety situation, not only a digital one. iCall (9152987821) provides psychological support. The National Commission for Women helpline is 7827170170. Tell someone you trust offline: your physical location, your schedule for the next few days, and who knows you’re dealing with this.
Tell someone offline. This is not optional. Doxxing is designed to isolate its targets — to make them feel visible to hostile strangers and invisible to everyone who might help. Breaking that isolation is part of surviving it intact.
What platforms owe you
Twitter/X maintains a doxxing policy. Enforcement is inconsistent and has become more so since 2022. The policy exists. Whether it gets enforced depends on content moderation capacity that has clearly declined.
Reddit prohibits doxxing at the site level. Individual subreddit quality varies by several orders of magnitude. A well-moderated subreddit will remove doxxing within minutes. A poorly moderated one may take days or never.
India’s IT Rules 2021 are formally the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules. They require significant social media intermediaries (platforms with more than 5 million registered users in India) to do three things: appoint a Grievance Officer based in India, provide a working contact mechanism, and acknowledge complaints within 24 hours. If you file a complaint and receive no response within 24 hours, the platform may be in violation of its legal obligations under Indian law. Escalate to the platform’s India Grievance Officer directly. They are legally required to publish this contact information.
GitHub, as a code hosting platform, sits in a different regulatory category, but has its own content policies and has demonstrated willingness to act on doxxing repositories when specifically reported. The Bulli Bai takedown, however delayed, happened.
The consistent theme across all platforms is that reactive moderation is the norm. Content comes down after damage is done. Pre-emptive protection is therefore personal rather than institutional — you cannot rely on platforms to prevent your doxxing, only to eventually respond to it.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.