Doxbin (darknet)

Doxbin

File:Doxbin Logo.png
Homepage of Doxbin on 26 April 2022
Type of site	Dox publisher
Registration	Optional
Launched	May 30, 2011 (2011-05-30)
Current status	Active
Written in	PHP

Doxbin is a document sharing and publishing website which invites users to contribute personally identifiable information, or "dox", of any person of interest. It was previously operated on the darknet as a Tor hidden service, by a person known on the internet as nachash. Since its takedown in 2014, nachash has stepped down and relinquished his ownership to a predecessor that used the username "King Oren" when interviewed. He said in an interview that he is hosting Doxbin on the World Wide Web, as well as on Darknet and Tor hidden service websites. He declined to release the link to either of them, saying, "The people that use the service know how to find it, that's what keeps it secure and out of the reach of incompetent people using it for malice things".

Due to the illegal nature of much of the information it published (such as social security numbers, bank routing information, and credit card information, all in plain-text), the old Doxbin was one of many sites seized during Operation Onymous, a multinational police initiative, in November 2014. Even though this type of material was technically not illegal, it was still taken down which lawyers responded to as "because they could."

The new Doxbin is operated by people on the internet known as "Brenton" and "kt".

History

The original (onion based) Doxbin was established to act as a secure, anonymous venue in May 30, 2011 for the publication of dox first established by people by the usernames of nachash, king oren, CGOD, and Phocus. Dox being a term in Internet culture which refers to personally identifiable information about individuals, including social security numbers, street addresses, usernames, emails, and passwords, obtained through a variety of legal and illegal means.

In November 2012, Doxbin's Twitter handle @Doxbin was attributed to an attack on Symantec, coordinated with Anonymous' Operation Vendetta.

It first attracted attention in March 2014 when its then-owner hijacked a popular Tor hidden service, The Hidden Wiki, pointing its visitors to Doxbin instead as a response to the maintenance of pages dedicated to child pornography links. In June 2014, their Twitter account was suspended, prompting the site to start listing the personal information of the Twitter founders and CEO. In October 2014, Doxbin hosted personal information about Katherine Forrest, a federal judge responsible for court rulings against the owner of Tor-based black market Silk Road, leading to death threats and harassment.

Doxbin and several other hidden services were seized in November 2014 as part of the multinational police initiative Operation Onymous. Shortly thereafter, one of the site's operators who avoided arrest shared the site's logs and information about how it was compromised with the Tor developers email list, suggesting it could have either been the result of a specialized distributed denial of service attack (DDoS) or exploited mistakes in its PHP code. However, the site could still be restored easily by setting up a new domain.

Since nachash's raid, he has gone on to write a darknet market vendor guide entitled "So, You Want To Be a Darknet Drug Lord…". and is claimed to have gone MIA in 2015

The new Doxbin claimed nachash shared a Doxbin template-like code on GitHub, which people have since been using inefficiently and that have been taken down after short periods of time. The new Doxbin claims to overcome these issues standing for "highest availability possible".

New Doxbin

The onion Doxbin seized by the FBI when Operation Onymous occurred.

Onion based Doxbin logo

In late 2018, a new Doxbin site on the World Wide Web, which has since been up and the current one being used.

The new service, claims to "stand for the highest availability possible." and that "your submitted doxes will stay up" (as long as they follow the site's privacy policy and TOS). The site also has multiple domain mirrors (alternatives) in the case of a domain takedown. Additionally claiming to not store any access logs or IP's but only a browser user agent string.

Legality

Because it is hosted in Europe, Doxbin has to follow the GDPR law.

Doxbin does not allow any minor, illegally obtained or harassing/threatening info. It is legal as of GDPR law. Using Section 230 of the Communications Decency Act to be immune to liability and cyberstalking/stalking law, it has an email for law enforcement which this all makes it legally immune.

The privacy section about the illegal information, mentions that they do not allow illegally obtained material and instigates by saying "Can anybody prove it? Not unless you brag about it.", it also says that "Doxbin was not made for harassment, intimidation or to cause nuisance." but also mentions that "It is impossible for some php code to harass somebody."

"Any pastes directly threatening and/or attempt to injure or hurt any particular individuals will be swiftly removed."

"Hall of Autism"

The Hall of Autism is a page on Doxbin that has a list of notorious doxes, and that is used to insult people based on their regrettable pasts and things they've done, such as "script kiddies". It also has pedophiles and other like-minded people.

It's mostly big notorious doxes in the community that are added there.

Database Leak

In November 2021, Doxbin was sold to a person under the alias "White". According to kt and Brenton, he proceeded to do nothing but break the site and get bullied. He then put the site up for sale again.

Brenton and kt offered to buy Doxbin back and White agreed, but due to him not being a part of the project anymore, he got demoted in Doxbin's community Discord server.

White then got "upset" and tried to steal Doxbin's Discord server vanity invite (a custom public server invitation link) and attempted to also take back the domains and Telegram group.

White refused to hand over Doxbin's Twitter account, but kt hacked into it. Though he couldn't change the email or password. "kt" then used that account to tweet something against Twitter's TOS and Guidelines, which ended up getting the account banned. In Doxbin's official post, they wrote a statement saying "If we can't have it, nobody can."

Between 9th November 2021 - January 4th 2022, anyone who logged into Doxbin had their account credentials leaked in plain text. Bcrypt hashed passwords (before White owned Doxbin), blacklist information, 2FA secret codes, also got leaked with it.

kt and Brenton say "The compromised data is an issue, and will impact our reputation heavily; but it happened and we cannot change it."

White and Lapsus$

White was doxxed, but he was also a member of a new ransomware group called Lapsus$ which had a list of notable breaches, such as ones from Nvidia or T-Mobile.

White's house got raided on the morning of April 1, 2022 and earlier in December 2021, both for relations to Lapsus$

However, when Lapsus$ got caught, White got charged with:

• Three counts of unauthorized access to a computer with intent to impair the reliability of data.
• One count of fraud by false representation.
• One count of unauthorized access to a computer with intent to hinder access to data.
• One count of causing a computer to perform a function to secure unauthorized access to a program.

The UK National Health Service confirmed that the dox was used in the police investigation. ("The UK National Health Service has confirmed this paste helped in the police investigation.")

Notes

1. The "White and Lapsus$" section contains info from a source that violates Wikipedia's privacy guidelines. Therefore no citations will be added. Same for section "Legality"[[#ref_{{{1}}}|^]]
2. The sources in "Database Leak" section use impudence and trash talk and come from a blacklisted source[[#ref_{{{1}}}|^]]
3. Do not add links to the site itself, as it is blacklisted.

See also

• Cyberstalking legislation
• Internet privacy
• Privacy law