What is doxing? A glimpse into the battle for anonymity on social media

“Would you like to know who’s hiding behind @CapitanBitcoin?” This was a question posed by the X account @Wiesenthal1632. It was an announcement of an imminent act of “doxing,” or the revelation of personal information about someone online.

Since the beginning of the year, a small team coordinated by Isidoro Román Cuesta has revealed the identities of more than 20 people managing anonymous social media accounts. “The first thing we try to do is detect hate campaigns that are being implemented online,” Román Cuesta explains during a phone interview with EL PAÍS. “The red line they cannot cross,” he warns, “is when they organize themselves to spread [hateful rhetoric, with the intention of] harassing or threatening other accounts, so as to intimidate them into silence.”

A tweet by Isidoro Román, in which he teasingly asks his followers if they’d like to know the identity of the user behind a right-wing X account called @CaptainBitcoin

The justification for doxing someone depends on the doxer. A “hate campaign” being waged by the “far-right” doesn’t mean the same thing for a left-wing voter as it does for a conservative voter. A sensitive topic that requires further investigation, doxing is a controversial activity, but it’s becoming more common.

In Spain, since the start of 2025, there’s been a wave of doxing taking place on X. Accounts with tens or hundreds of thousands of followers – such as Captain Bitcoin, Sr. Liberal, Captain Spain and Noa Gresiva (built out of the phrase “not aggressive”) – have been doxed. Most are conservative accounts that were revealed by Román Cuesta, but several progressive ones have also been affected in response.

Doxing emerged with the internet in the 1990s. When someone got angry with another person on an online forum, they would reveal information or documents about them, hence the name: dropping docs, abbreviated as “dox.”

Beyond the national political climate, there are two reasons that facilitate the increase in doxing. This is according to Pedro Anguita, a professor at the University of Los Andes (Chile) and author of research on these digital acts of exposure. First, he notes, “social media regulation has been declining and doxing has become increasingly common, without adequate regulatory limits.” And second, “more and more digital users – especially those who frequently use social media – expose their activities every day, leaving an indelible mark,” Anguita adds.

The relaxation of social media regulations since Elon Musk’s purchase of Twitter, as well as his permissiveness toward extreme opinions and his growing role in (dis)information, means that the price of expressing opinions and having influence is higher. “When you speak uncomfortable truths so forcefully and reach more than half-a-million people, you’re [considered] annoying and you’re hated,” Álvaro Pau asserts, in a private message on X. He’s a nurse and creator of the Captain Bitcoin account. “Anonymity bothers those who can’t control the message, those who want to monopolize narratives. On networks like X, there’s increasing pressure to identify, label and censor,” he adds.

Aiman ​​Bardisi, creator of the progressive X account Noa Gresiva, believes that doxing is mutual, but its origins aren’t so clear. “In doxing, one party does it to the other because they believe they’re committing hate crimes against immigrants, trans people, or [other vulnerable groups]. The other side doxes as an act of revenge. My case [of being doxed] came right after the Captain Bitcoin case. It’s like revenge.” The origin of his doxing was Mr. Liberal’s account, but he doesn’t know who actually did it. “He posted [my personal information], but I don’t know who gathered all of it,” he details.

In these revenge situations, legal lines are sometimes crossed. Last weekend, a group of well-known progressive journalists in Spain reported that their private information had been disclosed (including addresses and phone numbers). This can be considered in a way doxing, but it can also represent more serious crimes.

How do you reveal the identity of an anonymous person? You don’t need to be a hacker or a specialist; a thorough digital investigation is enough. If someone has a large following on X, it’s likely they’ve had others accounts before. Perhaps some nickname or name jumps from one account to another. “Everything leaves a trace,” Román emphasizes. “During the Covid pandemic, we started detecting activity from the accounts we’re now doxing, especially [having to do with] hoaxes and the anti-vaccine camp. But basically, [their intention] was to destabilize the government.” These accounts usually aren’t managed by people who are skilled at hiding their digital footprints. Although, Román admits, some accounts that his collective wants to dox are resisting them.

In the past, many of the accounts that have now been revealed were deleted for violating community standards. “Many were closed precisely for spreading hate speech,” Román points out. “It’s a characteristic of all the accounts we’ve doxed. It’s not the first one they’ve had, nor the first time they’ve been closed for the content they spread,” he adds.

Román earns his living as a ceramist. And, on the side, he publishes his doxings in Diario Red, a digital media outlet led by Pablo Iglesias – a left-wing thinker who served as second deputy prime minister of Spain from 2020 until 2021 – and on X. “We don’t charge for this: we’re [actually] losing money, as well as hours that we could dedicate to our family or our work,” he says.

There’s always been doxing on Twitter, but in the past, the ideological battle was centered around so-called “reports.” Activist groups banded together on Telegram under names like Red Bird or Unga Unga Army to mass-report tweets or accounts to the company, in the hopes of getting them blocked for spreading hate speech, or for other reasons. But today’s greater permissiveness means that reports, even though they’re still being made, have less impact.

Román Cuesta’s nickname on X is “Wiesenthal,” a tribute to the Nazi hunter Simon Wiesenthal, who operated in the 1950s and 1960s. Among his revelations are individuals with totalitarian ideologies, such as the Alt Right Spain account, the leadership of a far-right group called Núcleo Nacional, or Jan Ersan Jávega, who used to pepper-spray immigrants and record his assaults, posting them online.

The goal of doxing is, obviously, to create problems for the doxed person. Many of the accounts close and disappear. One of Román’s latest revelations was @Toroenreposo, allegedly run by a businessman linked to a famous family. The account owner eventually deleted it. “After [we removed] his mask, he put a lock on his account,” Román wrote at the time. Many accounts block public access after doxing occurs, taking advantage of the situation to delete troubling messages.

This war has even reached high-level politics. Spain’s Transportation Minister Óscar Puente joked on X about one of the doxed accounts – @capitana_espana – whom he referred to as “Manolo” several times (even though the person behind that account is actually a woman). The far-right Vox legislator Manuel Mariscal Zabala has claimed that “some media outlets have tried to reveal the identity of the people behind the accounts that criticize the [sitting left-wing] government and dismantle its ideological narrative.”

Román accuses Mariscal Zabala of coordinating and financing these accounts to generate hate: “These are campaigns launched at the same time, retweeting the same accounts and the same content. It’s something we’ve clearly identified.”

So, is anonymity an issue? Román clarifies that the problem is more about how anonymity is used. “I have anonymous accounts, but I don’t think anyone should be able to hide behind anonymity to commit a crime. It’s like a criminal trying to evade the police by wearing a hood so they can’t identify him.”

Revealing someone’s identity can create difficulties. “At first, it’s like staring into an abyss. You’re at home and you’re bombarded with insults, with your photo all over the place,” Bardisi recalls. The profile of those who are doxed varies greatly. Most are very interested in expressing their points of view. However, there are also public officials, businesspeople, or users whose online behavior is very different from their behavior in the real world, and they’re the ones who disappear from the internet once exposed.

Doxing can also have some positive consequences. Álvaro Pau, for instance, started a YouTube channel and is now considering the possibility of hosting a podcast. “I’ll put politics aside for a bit to try to provide real value to those who watch me,” he chuckles. “Going from 0 to almost 15,000 followers on YouTube [after being doxed] with just a couple of videos is the amount of work some people achieve in years of posting. This has made me think that maybe I can help more by talking about other things,” he adds. Jesús Santorio, revealed as the man behind @Sr Liberal, has launched a GoFundMe to fund a lawsuit against Pablo Iglesias and his publication. He’s raised almost 9,000 euros ($10,550) from 400 donors.

It remains to be seen whether these court cases will make any headway, especially in criminal courts. Román take care to only publishe information that’s already available publicly, names and photos the person has already shared on social media. There are no addresses or private information. “I’ve sought [legal] advice,” he notes, “and so long as I don’t publish private information, I won’t have any problems. All the information we’ve published comes from open sources. [Could it] fall into the hands of a judge who’ll [determine] that we’ve implemented a harassment campaign? No way.”

Jorge García Herrero, a lawyer, finds it unlikely that a severe punishment would be imposed, although he believes there may be some basis for filing a complaint. “Public figures – such as politicians, actors, or influencers – cannot demand the same protection of their data as anonymous tweeters with fewer than 500 followers. But anonymous accounts are very specific: these are people who choose to protect their identity, and that deserves protection. I believe the [Spanish Data Protection Agency] would sanction the non-consensual disclosure of such a person’s identity. And I believe the consequences at the administrative, civil and criminal levels will largely depend on how effective the anonymous tweeter’s precautions were as they sought to protect themselves,” he explains.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition