Preface: Internet surfing in 2026.

I first heard the term 开盒 (kāihé, “doxxing”) a few years ago, when Threads was just taking off. If you posted in Chinese, your Threads feed would fill up with Chinese-language content. The vibe was fascinating at first — people said it felt like early Weibo, or Douban. Chinese-language social media had long been tightly censored, and Threads seemed like a new oasis, a gathering place for LGBTQ voices and the “non-mainstream,” with native Chinese speakers from Taiwan, Singapore, Malaysia, Thailand, and the mainland all talking to each other. After scrolling for a while, I noticed the Chinese-speaking KOLs all followed one another, and gradually the usual online chaos crept in — personal attacks, arguments over everything. Then I heard that even on Threads, some people felt unsafe. That’s when I came across the word “doxxing.” I asked around: what does it mean? I learned it means exposing someone’s identity without their consent. In China, having your identity exposed and linked to what you’ve said online is dangerous — unlike the self-uploading, self-sharing culture of American social networks, a lot of information there is sensitive.

“Doxxing” is internet slang for collecting someone’s real identity, home address, phone number, national ID number, family relationships, and other private information through illegal or improper means, then publishing and spreading it online — often alongside incitement to abuse, harassment, or offline intimidation. It’s also called “human-flesh doxxing” or “doxx-and-shame.” This isn’t ordinary “looking someone up” or public debate. The key difference is the goal: to identify, expose, or disseminate the sensitive personal information of a specific, real person, putting them at risk of cyberbullying, phone bombing, threats, and stalking. Even public information, stitched together and cross-referenced to harass someone, can cause real harm. Since the forum era, the Chinese internet has had a tradition of the “human flesh search” (人肉搜索), powered by crowds of volunteers.

In the early days it even had a whiff of playfulness. In 2001, someone posted a photo claiming the woman in it was his girlfriend; netizens quickly identified her as a model who did image campaigns for Microsoft. That episode is usually counted as the first. What really revealed its power was the kitten-crushing video of February 28, 2006 — a woman in stilettos stomping a kitten to death. Netizens spent six days tracing the filming location to Heilongjiang and identified the three people involved; the forums’ own description at the time was that their efficiency rivaled the police. Two months later came the “Tongxu Gate” scandal (铜须门), sparked by a leaked chat log: within days, the accused young man’s real name, school, home address, photos, girlfriend, and phone number were all online — some of it later proven false. In December 2008, the same methods were turned on a housing bureau chief: within seven days, investigators found he smoked 1,500-yuan-a-carton cigarettes and wore a 10,000-yuan watch; this time public opinion called it oversight. The same set of moves can be justice or a manhunt — it depends on the target.

The human flesh search gradually became normalized — until late February 2006. A set of photos began circulating online: a woman in high heels crushing a kitten to death, her face clearly visible. Netizens responded with a post calling itself a “civilian wanted notice,” using the language of an arrest warrant. Within six days, people traced the location to Heilongjiang from the vegetation, buildings, and a sliver of road sign in the background, narrowed it to Luobei County, and identified the woman as a nurse at the local hospital and the cameraman as an employee of the county TV station. On March 10, the Luobei County government issued a statement. Both lost their jobs. The human flesh search had acquired a fixed vocabulary and a clear self-image: it did what the law couldn’t. That framing would be invoked again and again — and occasionally, it actually worked.

At the end of 2007, China saw what came to be called the “first case of cyber violence”: on December 29, a woman named Jiang Yan died by suicide, leaving behind a blog documenting her husband’s affair. Starting in January 2008, her former classmates compiled the contents and posted them online; netizens dug up her husband Wang Fei’s name, home address, workplace, ID information, and his family’s details. Wang received threatening emails, lost his job after his workplace was harassed, and notes were repeatedly pasted on his parents’ door. In February he sued three websites. That December, the Chaoyang District Court in Beijing ruled that Zhang Leyi, administrator of the site “Beifei de Houniao” (北飞的候鸟, “Northbound Migratory Bird”), had violated privacy and reputation rights — ordering posts deleted, a public apology, and 5,000 yuan in damages. Daqi.com was ordered to pay 3,000 yuan for running a special feature page; Tianya, which had deleted the posts before being sued, was deemed to have fulfilled its duty of care and bore no liability. Zhang appealed; the appeal was rejected.

If the human flesh search was still the spontaneous collaboration of strangers, doxxing was born smelling of organization and business. The term itself entered common usage relatively late, around 2021, supposedly emerging from Baidu Tieba. It began as a long-running war between Genshin Impact players and Tieba users, which the participants themselves called the “Box Wars” (盒战争). Cyberbullying is one person surrounded by a mob — the roles are clear. In the Box Wars, both sides had targets and both sides had dossiers: you post my data, I dig up yours and post it back; your friends, your forum’s moderators, anyone who ever spoke up for you — all on the list. Escalation didn’t mean nastier insults; it meant widening the blast radius to families. That’s why the records are full of “so-and-so’s parents” and “so-and-so’s school” — not because the parents joined the argument, but because by the late stages, family was the only chip left to raise. On the surface it was a fight over a video game; underneath it was a fight over moderator power — who became a bar moderator (吧主), who got removed, which faction controlled pinned posts and deletions. Doxxing here was a means of seizing power, not venting anger. A moderator’s resignation could trigger a round; so could losing an argument, or backing the wrong side.

For an adult doxxed by strangers, exposure is basically the end of it: a wave of harassing calls, a wave of account spam, and life goes on. For a minor, exposure is only the delivery — the execution happens the next day in the classroom, on the family’s landline, with the homeroom teacher. In 2019, in Mianyang, Sichuan, Wu Jie was in her second year of high school. She touched up a few photos of her idol at an offline event on her phone and posted them to Weibo. During a single PE class that day, the post passed 20,000 views and over a hundred likes. In the comments, someone accused her of malicious retouching, of deliberately erasing her idol’s blemishes. Wu Jie’s own account was that she’d only done normal touch-ups, nothing that changed how her idol actually looked. She deleted the comment. The other person switched to DMs: “My brother’s a hacker — want me to have him dig up everything about your family?” She didn’t back down. They argued in DMs, and mid-argument she clicked into the other person’s profile, decided this looked like a middle schooler, and pretended to be an adult, urging them to focus on school. Minutes later, an Alipay notification popped up. A stranger’s account with an anime avatar had sent 0.01 yuan, with a note: “Wu Jie, watch yourself.” Between classes, Wu Jie hid in a bathroom stall scrolling her phone; after trying several stalls she found the innermost one had the best signal. Her phone stayed on silent the whole time; she kept checking for new threats, and every sound in the hallway, every notification, set her on edge. She later said she developed tinnitus during that period. Fourteen days later, she deleted her account and left the fandom.

Worse than Wu Jie’s case is Gao Fei’s. Gao Fei is a pseudonym. He was first doxxed at eleven, for piling onto an insult aimed at a big name in the “penzi” (喷系) flame-war scene in a group chat. The second time came during a conflict in which more than thirty people in the whole group were doxxed together — including his father’s household registration info. The third time, in his first year of middle school, it was the entire family: his parents, his paternal grandparents, his father’s elder brother and sister-in-law, his elder cousin, his great-aunt, and his maternal grandparents — names, photos, ID numbers, phone numbers, home addresses, all laid out on a single template like an internet wanted poster. After that came hundreds of harassing calls and texts a day; his family blamed him, and they fought constantly. “The mental pressure was huge — I’d dragged my family into being harassed too.” He didn’t quit. “You want to argue with me? Then I’ll see it through to the end. Piss me off and I’ll hit back,” he said. His schooling had already fallen behind; after this, he dropped out.

After dropping out, he started learning how to dox. Online tutorials only skim the surface of social engineering; the real channels are insiders — the scene recruits industry practitioners long-term, negotiates the split, and shares the payout once a dox lands. The other channel is offshore “social engineering databases” (社工库), vast troves of illegally aggregated leaked data, cheap to query. Hard targets get the brute-force treatment: enumerate every possible combination of a fixed string of digits, verify them one by one, and piece together an ID number — once you have that, the rest is easy. “The first time I doxxed someone’s info, I felt a real sense of accomplishment.” He described being possessed, doxxing people for no reason at all — even people who’d never insulted him; he’d go pick a fight first. Soon people were asking to apprentice under him. Phone numbers, ID numbers, and household registration addresses were just the basics for him; below that came spending records, marriage history, entry-exit records, property holdings, transit records, food-delivery and shopping addresses, criminal records, phone geolocation, chat logs. At his craziest, he doxxed over a hundred people in a month.

According to him, the scene’s organizational structure was remarkably complete. Members had to use unified usernames and faction identifiers across platforms, and keep everything secret from outsiders. The internal division of labor was “some people handle the flaming, some handle the doxxing, some handle the offline ambushes” — his exact words were that it ran like a company. The scene cared intensely about face: losing a flame war meant being mocked for a long time after. Each faction held shared dossiers they called the “arsenal” (军火库) — hundreds of people’s screen names, real identities, and faction affiliations — plus videos of offline beatings, concessions, apologies, and kowtows, kept as proof of victories. Harassment had scripts; he’d seen someone control more than three hundred QQ accounts, all hurling abuse at one person at the same time. It was also a business. Taking orders to dox people and taking on apprentices both paid; the scene’s big names had regular clients, and some made over 10,000 yuan a day. Pricing depended on difficulty; undercutting the price would bring trouble from rivals, and different crews could come to blows fighting over high-margin clients.

According to a counselor interviewed for the story, most of the students involved knew it was illegal, but believed their minor status would protect them. Before January 1, 2026, that judgment was basically correct: no administrative detention at all for ages fourteen to sixteen, and none for first-time offenders aged sixteen to eighteen. In the Bilibili case, of the two underage organizers, one was detained for ten days and the other only received a disciplinary talk — the difference probably came down to exactly this. The newly revised Public Security Administration Punishments Law, effective this January, changed that: detention can now be enforced for ages fourteen to sixteen with two or more offenses within a year, and for ages fourteen to eighteen even on a first offense if the circumstances are serious and the impact egregious; it also lists student bullying as a standalone category for the first time. In March 2025, the thirteen-year-old daughter of a Baidu vice president doxxed ordinary people during a fandom dispute — one of them a pregnant woman. The data was bought from an offshore database, which is to say it could have come from anywhere. Private doxxing is normally a public-security matter: up to ten days’ detention and a fine of up to 500 yuan — and for a thirteen-year-old, even that basically doesn’t apply; civil liability falls on the parents.

From a photo on MOP in 2001 to the offshore social-engineering database on a thirteen-year-old girl’s phone in 2025, doxxing has traveled a complete arc: from game, to weapon, to business. In the era of the human flesh search, participants at least believed they were serving justice; in the era of doxxing, even that justification is unnecessary — it serves factions, traffic, and profit, more efficient and more naked. The 2026 rules tightened the opening a notch, but technology always outruns the law, and this race is probably far from over. Note to self: the internet is dangerous — use with caution. 😳