Doxbin was a document sharing and publishing website which invited users to contribute personally identifiable information, or "dox", of any person of interest. It was previously operated on the darknet as a Tor hidden service, by a person known on the internet as nachash. Since its takedown in 2014, nachash has stepped down and relinquished his ownership to a predecessor that used the username, king oren, when interviewed. He told in an interview that he is hosting the Doxbin on public access, referring to World Wide Web, as well as on darknet and Tor hidden service websites, although he would not release the link to either of them, saying, "The people that use the service, know how to find it, that's what keeps it secure and out of the reach of incompetent people using it for malice things."

Due to the illegal nature of much of the information it published—such as social security numbers, bank routing information, credit card information, all in plain-text—it was one of many sites seized during Operation Onymous, a multinational police initiative, in November 2014, which led to the seizure and capture of nachash and king oren, forcing them to hand over the website files along with any website associated things, as well as facing serious felony charges for several computer crime related charges. The website was restored under different ownership in the same month.

A similar such hidden service site for doxing is Cloudnine.[1][2]


Doxbin was established to act as a secure, anonymous venue for the publication of dox first established by people by the usernames of nachash, king oren, CGOD, and Phocus. Dox being a term in Internet culture which refers to personally identifiable information about individuals, including social security numbers, street addresses, usernames, emails, and passwords, obtained through a variety of legal and illegal means.[3][4]

In November 2012, its Twitter handle @Doxbin was attributed to an attack on Symantec, coordinated with Anonymous's OpVendetta.[5]

It first attracted attention in March 2014 when its then-owner hijacked a popular Tor hidden service, The Hidden Wiki, pointing its visitors to Doxbin instead as a response to the maintenance of pages dedicated to child pornography links.[6][7][8] In June 2014, the official @doxbin Twitter account was suspended, prompting the site to start listing the personal information of the Twitter founders and CEO.[9] In October 2014 Doxbin hosted personal information about Katherine Forrest, a federal judge responsible for court rulings against the owner of Tor-based black market Silk Road, leading to death threats and harassment.[3][4][10][11]

Doxbin and several other hidden services were seized in November 2014 as part of the multinational police initiative Operation Onymous.[12][13][14] Shortly thereafter, one of the site's operators who avoided arrest shared the site's logs and information about how it was compromised with the Tor developers email list, suggesting it could have either been the result of a specialized distributed denial of service attack (DDoS) or exploited mistakes in its PHP code.[12][13][15][16] The site was then transferred to new owners who reclaimed it from authorities and restored it just a week after it went down.[3][4]

Following this raid, the site is no longer run by nachash, but it has been reopened by a predecessor known as king oren who is currently hosting the Doxbin on public access internet, along with deep web links that he would not release during an interview. Following nachash's raid, he has since then gone on to write a darknet market vendor guide entitled 'So, You Want To Be a Darknet Drug Lord…'.[17]

See also


  1. ^ Trend Micro. "Below the Surface: Exploring the Deep Web" (PDF). Retrieved 12 July 2015. 
  2. ^ AsiaOne (6 July 2015). "8 things you didn't know about the Deep Web". Retrieved 12 July 2015. 
  3. ^ a b c Caraluzzo, Carlo (14 November 2014). "Darknet Hackers Retake Control of Seized Doxbin from FBI". Coin Telegraph. Retrieved 25 January 2015. 
  4. ^ a b c Howell O'Neill, Patrick (10 November 2014). "Dark Net hackers steal seized site back from the FBI". Daily Dot. Retrieved 25 January 2015. 
  5. ^ Hanna, Paul (5 November 2012). "'Remember, Remember': Anonymous marks November 5 with hacks, protests". Retrieved 25 September 2015. 
  6. ^ Howell O'Neill, Patrick. "Deep Web hub hacked and shut down over child porn links". Daily Dot. 
  7. ^ Mead, Derek (13 March 2014). "A Hacker Scrubbed Child-Porn Links from the Dark Web's Most Popular Site". Vice. 
  8. ^ "Twitter Founders' Personal Information Released on Doxbin". Darkweb News. 12 June 2014. 
  9. ^ Tarquin (June 12, 2014). "Twitter Founders' Personal Information Released on DOXBIN". Retrieved 20 August 2015. 
  10. ^ Komando, Kim. "Cybercriminals terrorize federal judge. Now they've done something really scary". KimKomando.com. 
  11. ^ "Site Doxx'es Judge of Silk Road Case – Calls To "Swat" Her". DeepDotWeb. 13 October 2014. 
  12. ^ a b Rauhauser, Neal (11 November 2014). "Doxbin's Nachash On Operation Onymous (P.1)". DeepDotWeb. Retrieved 25 January 2015. 
  13. ^ a b Gallagher, Sean (9 November 2014). "Silk Road, other Tor "darknet" sites may have been "decloaked" through DDoS". Ars Technica. 
  14. ^ O'Neill, Patrick Howell (17 November 2014). "Tor eyes crowdfunding campaign to upgrade its hidden services". Daily Dot. Retrieved 25 January 2015. 
  15. ^ Muadh, Zubair (12 November 2014). "Doxbin's Nachash On Operation Onymous (P.2)". Deepdotweb. Retrieved 25 January 2015. 
  16. ^ nachash [handle]. "[tor-dev] yes hello, internet supervillain here". [tor-dev] mailing list archive. 
  17. ^ DeepDotWeb (15 April 2015). "So, You Want To Be a Darknet Drug Lord…". Retrieved 21 September 2015.