How you get de-anonymised, and how to stop it

Almost nobody is “hacked” in the movie sense. They're cross-referenced. Doxxing is the craft of taking pieces you left in public, each one harmless, and gluing them back together until they yield a name, a town, sometimes an address. A handle here, a photo there, a number on an old account: taken together, that's enough.

This guide describes these methods for one reason: you only defend well against what you understand. Each section explains an entry point from the angle of the person using it, then how to close it.

The raw material: a handle that follows you

The first reflex of whoever's looking for you isn't technical: they type your handle everywhere. Free tools automate this, testing one username across hundreds of sites in seconds. If you use the same handle on a game, a forum and a social network, those accounts link up, and one of them always ends up holding a real piece of information: a dated photo, a first name, a town.

Alongside that, services aggregate past data breaches. With a name, an email or a number, they surface what has already leaked about you elsewhere. You can't undo a leak, but you can break the links.

The defence: a different handle per use, a unique password per account, and an email address reserved for what matters. Check what has already leaked on haveibeenpwned.com, and wherever an account shows up, change the password and cut its link to the rest.

The trap link

An attacker makes a link that looks like it goes to a video or an image, but first passes through a server of theirs. The moment you click, that server logs your IP address, and with it: your internet provider, your region, often your city, the device model, the time zone, sometimes the battery level. The IP alone doesn't give your door, but paired with the provider it narrows the circle a lot. These links are dressed up to look like a normal link.

The defence: don't click a shortened or unknown link sent in a private message, especially a “you have to see this” one. A VPN hides your real IP address from the link's server, which is exactly where it earns its keep. Be wary of a link from a friend: if they've been caught themselves, the message forwards itself to their contacts.

The file and the fake QR

Some files run code the moment you open them. The risky extensions are well known: a file that presents itself as an image but that you have to “download to view” is one of them. On messengers, a common variant is token theft: a desktop app sometimes stores your login token in the clear, and malware reads it then sends it to a third party, who then signs into your account with no password. Same logic with a fake “verification” QR code to scan: scanning it actually approves a login on the attacker's device.

The defence: don't open a file from a stranger, least of all an executable. Don't use a messenger's desktop app for a sensitive account, prefer the browser. Never scan a QR “to prove you're human”. And if a site or a person asks you to paste a snippet of code into the browser's developer console, that's a token theft, never a verification.

Two false good ideas while we're here: “free subscription” generators are, most of the time, malware; and “remember me” on a shared device stores a token worth your password if someone steals it.

The photo that talks

A photo carries two layers of information. The first is hidden in the file: EXIF metadata can hold the device model, the time, sometimes the exact GPS coordinates. The second is in the image itself. A patient investigator cross-references the day's weather, the vegetation, the shape of a hill in the distance, a road marking, the angle of a shadow, and narrows it down to a town. A plain photo of the car park in front of your home, a window, a parcel with a label, a map on screen: each one is one clue too many.

The defence: strip metadata before posting an image, and never use a personal photo or a place near your home as a profile picture. Don't post live from where you are, delay it. An address, even an approximate one, is more dangerous than an IP address: it doesn't change.

Impersonation

When the technical route falls short, they go through you. A fake message built from a screenshot, a voice cloned by an AI from a few seconds of recording, an email dressed up as a service you use, a call posing as support after a “problem on your account”: all of it aims to make you hand over the information or the click yourself. It's often the step that follows a doxxing, to turn an address or a number into real access.

The defence: check the exact address of a payment site before entering anything, character by character. Never trust an unsolicited call or email that manufactures urgency, call the service back on its official number. A hurried contact who needs a code “right now” is the signal, not the exception.