How you dox yourself

Most doxing writeups assume an attacker: someone actively hunting your name, cross-referencing databases, building a file. That does happen. But the more common failure mode is quieter and has no attacker at all — it’s a profile you built yourself, one convenience feature and one reused habit at a time, that sits there waiting for anyone who eventually looks.

This post is about that second case: the accidental kind. What actually leaks, why it leaks, how to check your own exposure, and what to do if someone points a doxing effort at you anyway.

cat table_of_contents.txt

1. What doxing actually is
2. The vectors: how people dox themselves
3. Running a self-audit
4. If you’re already doxed
5. The legal angle, generally
6. Sources (defanged)

What doxing actually is

Doxing — from “dropping docs” — is compiling and publishing someone’s private or identifying information without consent, usually to harass, intimidate, or enable others to do so. The individual facts involved (a name, a workplace, a neighborhood, a phone number) are frequently unremarkable on their own and often already public somewhere. The harm is in the aggregation: turning scattered, low-signal facts into a single dossier that removes the friction between a stranger online and your physical front door.

That framing matters for defense. You’re rarely defending one secret. You’re managing how many of your public fragments can be correlated together, and how easily.

The vectors: how people dox themselves

Ranked roughly by how often they’re the actual source, not the sensational one:

• EXIF metadata in photos. Phone cameras can embed GPS coordinates, device model, and a timestamp directly in a photo file. Most mainstream social platforms strip this metadata from images on upload — but that’s a platform default, not a guarantee. Messaging apps, personal blogs, marketplace listings, and a file shared directly (email attachment, cloud folder link, AirDrop) often keep it intact. A photo taken from your front porch and shared “raw” can hand over the coordinates along with the picture.
• Reused usernames. The same handle across a gaming forum, a decade-old blog, and a current professional account is a free correlation key. Each platform leaks a little context — a real first name here, a city there, an employer in a bio — and a shared username is what lets someone stitch them into one profile without any special access.
• Unredacted domain WHOIS records. Registering a personal domain (a portfolio, a small business, a vanity email) publishes your name, address, phone, and email in the public WHOIS record by default, unless you enable your registrar’s privacy/proxy service — most offer one, and many now default to it, but not all do, and older registrations can predate the default.
• Public code repositories and commit history. Git commits carry an author name and email by default. A personal project pushed with your real work email, or a .env file committed by mistake, sits in history forever even if you delete the file in a later commit — history has to be rewritten, not just edited, to actually remove it.
• Family and associate accounts. A relative’s public Facebook check-in, a partner’s tagged photo, a friend’s “here with [you]” post — this is exposure you don’t fully control, because it isn’t posted from your account. The fix here is a conversation, not a settings menu.
• Geotags and check-ins. Real-time location tags on posts or stories reveal a pattern, not just a point: post enough of them and an observer can infer your home, workplace, and routine without you ever tagging your address directly.
• Data broker aggregation. People-search sites compile public records — property, court filings, voter rolls where public, old address history — into a single searchable profile, often with an opt-out process buried a few clicks deep and worth doing once and rechecking periodically.
• Recycled credentials. Not doxing in the strict sense, but adjacent: a password reused across services means one breached, low-value site can expose the same credential guarding your higher-value accounts, and breach-correlation is exactly how some doxing efforts pivot from “an email address” to “an account takeover.”

Running a self-audit

Treat yourself as the target once, on purpose, before someone else does it involuntarily. All of this is passive — checking what’s already public, not accessing anything you’re not authorized to.

• Reverse image search your own public photos (Google Images, TinEye, Yandex all offer this) to see where they’ve been reposted or indexed, and whether an EXIF viewer shows embedded GPS data before you post the next one.
• Search your own name and usual usernames in a search engine, in quotes, and check whether a username-correlation tool turns up accounts you forgot existed.
• Look up your own domain’s WHOIS record to confirm registrar privacy is actually enabled, not just assumed.
• Run your primary email through a breach-checker (Have I Been Pwned is the standard, well-known one) to see which of your accounts have already been exposed in a breach, and rotate anything reused elsewhere.
• Check your social platforms’ privacy settings directly, since defaults change with product updates: who can see your friends/followers list, whether past posts are searchable, whether precise location is attached to new posts by default.
• Search a people-search/data-broker site for your own name to see what’s aggregated, and submit the opt-out — then put a reminder to recheck in six months, since these sites re-scrape.

None of this needs to happen all at once. A recurring quarterly pass catches drift better than one exhaustive lockdown that’s never repeated.

If you’re already doxed

Speed and documentation matter more than any single clever move:

1. Screenshot everything — the post, the URL, the timestamp, the poster’s account — before it can be deleted or edited. You need the evidence more than you need to react to it.
2. Report to the platform using its harassment/doxing reporting flow, which is usually faster than a legal process for getting content removed.
3. Lock down, don’t delete. Set accounts private, remove or freeze what’s easy to remove, and resist the urge to delete everything — a paper trail of what was posted is useful for reports and, if needed, law enforcement.
4. Tell the people who can act on it — your employer’s security team if it’s work-related, platform trust & safety, and, if there’s any physical safety concern, local law enforcement, without waiting to see if it “blows over.”
5. Assume republication. Content that’s been screenshotted or mirrored may still circulate after the original post is removed — plan around that rather than treating takedown as closure.

The legal angle, generally

This is general orientation, not legal advice — get qualified counsel in your own jurisdiction for anything you intend to act on.

Almost no country has a statute that names “doxing” directly, but the underlying conduct usually isn’t a legal vacuum — it typically falls under some combination of existing law, even without a dedicated dox statute:

• Harassment and stalking law. Most jurisdictions criminalise repeated, threatening, or fear-inducing communication regardless of the medium. A dox that’s paired with harassment (or is clearly intended to enable it) tends to fit within these provisions even where the publishing of information itself isn’t separately named.
• Identity theft and impersonation law. Where a dox involves assuming or misrepresenting someone’s identity, separate impersonation or identity-theft provisions often apply on top of any harassment claim.
• Data protection law. A growing number of jurisdictions (the EU’s GDPR being the best-known, but far from the only one) give individuals rights over data held by organizations — correction, erasure, objection to processing — enforced by a national data protection authority. That’s most directly useful against a data broker or people-search site that won’t honor an opt-out; it’s a weaker tool against an individual doing the doxing, since these laws are generally aimed at controllers and processors, not person-to-person disputes.

Where to report, practically: your platform’s own harassment/doxing flow first (fastest), then your country’s cybercrime-focused police unit for conduct that plausibly meets a criminal threshold, and your national data protection authority (where one exists) for a data-controller complaint. Which agency actually has jurisdiction, and what the reporting threshold is, varies enormously by country — check your own before you need it, not after.

Sources (defanged)

• hxxps://haveibeenpwned[.]com/ (breach-checker referenced above)
• hxxps://www[.]eff[.]org/deeplinks/2022/06/facial-recognition-and-doxxing (EFF — doxing and aggregation mechanics)
• hxxps://www[.]icann[.]org/resources/pages/gtld-registration-data-specs-en (WHOIS registration data and privacy-service background)
• hxxps://gdpr-info[.]eu/ (EU GDPR — reference text for the data-protection point above)