What Is Doxing?

Doxing — also spelled doxxing — is a term derived from the phrase “dropping dox (documents)”. Doxing is when a cybercriminal collects and exposes personal information about someone who wants to remain anonymous. While Doxxing is commonly a form of cyberbullying, one cybercrime group might also doxx members of another to expose them and their activities to the authorities.

How Does Doxing Work?

In the modern age, almost everyone has their personal information stored somewhere on the Internet. This information may be provided to companies, collected by government organizations, or otherwise uploaded to the Internet. Often, this information is public record or accessible via access to a user’s online accounts. Doxers may aggregate data from public sources and break into a user’s online accounts to determine their identity and collect a detailed profile before going public.

What Data Are Doxers Looking For?

The goal of doxing is to reveal the identity of someone who wants to remain anonymous. As a result, doxers may look for information that is tied to someone’s real-world identity, such an individual’s name, address, phone number, Social Security Number, photographs, social media profiles, employer, credit card data, and bank account information.

Doxing Methods

Doxxers can use various methods to collect information about their targets. Some examples of common tactics include the following:

• Username Tracking: Many people use the same username — often their email address — across many online accounts. This enables a doxxer to track and correlate a user’s online activity across websites and build a better picture of their activities.
• Packet Sniffing: Data flows over the Internet in packets. If an attacker can intercept these packets, then they can see some information about a user’s online activity.
• IP Loggers: IP loggers embed code to an email that calls back to the sender when the email is opened. This can reveal the recipient’s IP address.
• Reverse Lookups: Online services offer reverse phone and address lookups for a fee. This enables a doxxer to learn a user’s identity — as well as arrest records and other information — based on knowledge of their cell phone number.
• Social Media: People commonly post sensitive and personal information on social media. An attacker may examine publicly visible social media accounts and send connection requests for private ones to try to find hints about the owner’s identity.
• Government Records: Government records such as birth certificates, marriage licenses, deeds, and other records contain a wealth of information about a person. They are also often public records, making it possible for anyone to read them.
• Phishing: Phishing is a classic tactic for stealing sensitive information or the login credentials for online accounts. Doxers may use phishing to steal data or deliver malware to a target.

How to Protect Yourself from Doxing

Some sources of information — such as public government records — are outside of people’s control. However, there are some things that you can do to protect against doxxing, including the following:

• Strong Passwords: Doxxers may gain access to sensitive, personal information by collecting it from compromised online accounts. Using a strong, unique password for each website makes it more difficult for an attacker to gain access to these accounts and collect information.
• Multi-Factor Authentication (MFA): MFA can be another powerful tool to protect online accounts against compromise. Enabling MFA makes it more difficult for an attacker to use a stolen password.
• Use a VPN: Public Wi-Fi and other networks may be insecure, allowing an attacker to eavesdrop on network traffic. Using a virtual private network (VPN) encrypts traffic between your computer and the VPN endpoint, making it impossible to eavesdrop on it en route.
• Watch Out for Phishing: Phishing emails are a common tactic to collect passwords, install malware, and solicit sensitive information. Be wary of links, attachments, and requests for personal information in unsolicited emails.
• Lock Down Accounts: Social media and other online accounts commonly have various privacy levels and settings. Ensure that privacy settings are enabled to protect sensitive information.
• Think Before You Post: Social media can be a rich source of information for a doxer, and information posted on the Internet is there forever. Think before posting potentially personal or sensitive information on social media.
• Manage App Permissions: Apps commonly request excessive permissions and collect information about their users. This information could be sold to third parties or exposed if the app developer is hacked.
• Hide Domain Registrations: A domain registration for a website includes information about the domain owner and manager. This information can be made private by a domain registrar.

Prevent Doxing with Check Point

Doxers may use various attacks to collect information about potential targets. For example, they may send phishing emails or install malware on a user’s computer to collect personal information.

Check Point Endpoint Security provides robust protection against endpoint security threats.