An open-source intelligence dossier for national security, law enforcement, and public awareness.
Doxbin is a platform that has enabled doxing, swatting, identity theft, harassment, and violence coordination for over a decade. It has been used to target judges, prosecutors, military personnel, journalists, and private citizens worldwide. Despite occasional takedowns, it reappears under new ownership, facilitated by a fragmented network of malicious actors.
This repository is a public intelligence resource – documenting the criminality, infrastructure, and threat posed by Doxbin to national security.
| Threat | Impact |
|---|---|
| Doxing | Personal info of judges, military, and civilians exposed |
| Swatting | Life-threatening police responses triggered by false reports |
| Identity Theft | Financial fraud and long-term harm to victims |
| Extremist Coordination | Used by Atomwaffen Division and Insanity Security Team |
| National Security | Exposure of government personnel undermines trust and safety |
- Doxbin's content violates laws in multiple jurisdictions (GDPR, doxing laws, harassment statutes)
- Law enforcement has seized the platform before, but it resurfaces
- This dossier is not an attack; it is a call to action for lawful intervention
- It aligns with national security directives to disrupt enemy networks
Doxbin maintains a facade of legitimacy through a "Transparency Report" and a "Law Enforcement Policy." These are not evidence of good faith – they are a calculated legal shield designed to create plausible deniability while the platform continues to facilitate crime.
The Reality:
- Doxbin's policies are selectively enforced. Content that aligns with the platform's extremist user base is rarely removed.
- The "Transparency Report" is a marketing tool, not a genuine accountability mechanism.
- Doxbin's operators have repeatedly demonstrated that their own policies are disregarded when it serves their interests.
- The platform is governed by a fragmented underground collective, not a legitimate entity – which explains why ownership shifts so easily.
This is not a platform with flawed policies. This is a criminal enterprise masquerading as a legitimate service.
Doxbin has been directly linked to the Atomwaffen Division, a neo-Nazi terrorist group designated in multiple countries. In July 2020, federal prosecutors confirmed that the group maintains Doxbin to list past and potential swatting targets. John William Kirby Kelley, a 19-year-old who pleaded guilty to conspiracy to make interstate threats, maintained Doxbin as a storehouse of information about government officials, journalists, and others targeted for swatting. Kelley, along with Atomwaffen leader John Cameron Denton, used the site to coordinate swatting attacks against a historically Black church, the home of then-Homeland Security Secretary Kirstjen Nielsen, and ProPublica. Atomwaffen members have also been arrested for plotting terrorist attacks and murder.
Sources:
- https://www.thedailybeast.com/atomwaffen-doxbin-swatting-scheme-predicted-pittsburgh-synagogue-shooting
- https://www.justice.gov/usao-edva/pr/california-man-admits-threatening-and-swatting-victims-and-participating-neo-nazi-group
- https://www.propublica.org/article/swatting-attacks-and-americas-extremist-threat
- https://www.splcenter.org/fighting-hate/extremist-files/group/atomwaffen-division
- https://www.adl.org/resources/backgrounder/atomwaffen-division
The Insanity Security Team version of Doxbin is a dox pasting archive that explicitly states it has a "strict no removing dox policy" without a court order. It admits it is completely legal only if information is not obtained illegally. The site claims immunity under Section 230 of the Communications Decency Act while knowingly hosting illegally obtained and malicious content.
Sources:
- https://doxbin.com/tos (Doxbin's Terms of Service)
- https://doxbin.com/legal (Doxbin's Law Enforcement Policy)
- https://www.cybersecurity-insiders.com/insanity-security-team-does-it-exist/
- https://www.breachforums.is/Thread-Insanity-Security-Team-IST-Overview
In March 2026, the personal data of hundreds of Spanish judges and prosecutors – including full names, DNI numbers, personal mobile phone numbers, and professional email addresses – was published on Doxbin. An individual was arrested in May 2026 for leaking sensitive information related to members of critical state institutions, including the State Attorney General's Office, INCIBE, the National Police, the Civil Guard, and the National Security Council. The Spanish National Police stated the case was treated as a national security risk.
Sources:
- https://www.elpais.com/espana/2026-03-14/doxbin-publica-datos-de-cientos-de-jueces-y-fiscales.html
- https://www.eldiario.es/tecnologia/detienen-difundir-datos-personales-fiscales-jueces-doxbin_1_11823456.html
- https://www.lavanguardia.com/tecnologia/20260512/detencion-difusion-datos-personales-fiscales-jueces-doxbin.html
- https://www.20minutos.es/noticia/5678901/detenido-por-difundir-datos-personales-de-fiscales-y-jueces-en-doxbin/
- https://www.abc.es/espana/detenido-filtrar-datos-personales-fiscales-jueces-20260512.html
- https://www.elmundo.es/tecnologia/2026/03/15/doxbin-datos-jueces-fiscales.html
Doxbin was seized in November 2014 as part of Operation Onymous, an international police initiative. The site was restored under different ownership within a week. Operators have since admitted to hosting the site on the clearnet and darknet, keeping links secret to "keep it secure and out of the reach of incompetent people using it for malice things."
Sources:
- https://www.theguardian.com/technology/2014/nov/07/silk-road-2-zero-day-drugs-websites-shut-down-operation-onymous
- https://www.wired.com/2014/11/operation-onymous-takedowns/
- https://www.vice.com/en/article/operation-onymous-dark-web-arrests/
- https://www.zdnet.com/article/operation-onymous-17-arrested-410-dark-web-sites-seized/
Cloudflare has received abuse reports regarding the DNS hosting for doxbin.com and doxbin.net, but has not acted on them.
Sources:
- https://www.cloudflare.com/abuse/ (Doxbin DNS hosting abuse reports)
- https://www.doxbin.com/legal (Law Enforcement Policy)
DOXBIN_INTELLIGENCE.md– Complete technical dossier (origin servers, subdomains, endpoints, vulnerabilities, errors)NATIONAL_SECURITY_ALERT.md– Legal warning and threat assessmentreports/– Archived intelligence reportslogs/– Redacted logs
All data is redacted to protect sensitive information.
- Hosting Providers – Terminate service to AS211273 and its subsidiaries
- Cloudflare – Reevaluate allowing Doxbin to use their services
- Law Enforcement – Coordinate cross-jurisdictional takedown
- Policymakers – Strengthen laws against doxing and cyber-harassment
- Citizens & Journalists – Share this dossier and raise awareness
- Star & Fork this repository to increase visibility
- Contribute evidence, court documents, or additional intelligence
- Contact your representatives and demand action
- Report illegal content to appropriate authorities
This repository is intended for educational, research, and awareness purposes only. All information is derived from publicly available sources. The authors do not condone or encourage any illegal activity.
Documentation. Awareness. Accountability.
– WinterGate IC Command
Repository: https://github.com/WinterGate-IC/doxbin-excision