Secure and protectInternetDoxbin was one of the darkweb’s most malicious and notorious sites, publishing personal details regardless of the consequences, before being shut down by the FBI and Europol. Nachash, its admin, lifts the lid on the site’s history and ethos
The Guardian’s product and service reviews are independent and are in no way influenced by any advertiser or commercial initiative. We will earn a commission from the retailer if you buy something through an affiliate link. Learn more.
Operation Onymous last month did more than shut down hidden websites selling drugs.
The operation, led by the FBI and Europol, took down a swathe of Tor sites including one of the darkweb’s most notorious sites, Doxbin. It was where users and admins posted the names, addresses, social security numbers, healthcare histories and other personal details in a spirit of digital vigilantism – or plain malice.
People can find themselves targeted for a host of reasons. Some are targeted for getting on the wrong side of online communities, some for political reasons. Others openly court attention by insulting Doxbin’s owners, including the former owner of the site nachash, who has spoken to the Guardian.
There are two ways to identify a victim, according to nachash. The first, which he says is usually employed by irate kids seeking revenge on Xbox Live opponents, is crude: get a target’s IP address, use it to trick an internet service provider into handing over data, and then buying personal information from a site called SSNDOB, which sells social security numbers, birthdays and more. Collate all those details, post them and then leave it to users to decide what they want to do, if anything.
But the second kind of doxing is an art, says nachash, who enjoys a dark detective story. It involves online sleuthing, grabbing personal data from social networks, Google searches and other open databases.
Nihilistic, not moralistic
When it went live in May 2011, some thought Doxbin would support the likes of LulzSec and Anonymous in releasing information on political and other deserving targets, but users tussled with the hacktivists and deanonymised some members of the Swedish branch of Anonymous just for the fun of it.
Although nachash would never define rules for the site users, he had a nebulous one of his own: to expose “shitheads who had it coming”. You irk him, he’ll dox you.
“Jason Lee Van Dyke was patient zero in that regard,” says nachash.
Van Dyke is a lawyer from Texas who attempted to sue the Tor Project earlier this year. He was representing Shelby Conklin, a criminal justice student at a Texas university, after she was a victim of revenge porn site PinkMeth, which was also shut down by US authorities in November. Nachash was friendly with those at PinkMeth and regarded the lawsuit, which has now been dropped, as an attack on Tor.
Van Dyke picked a fight with PinkMeth in September over the site’s all-too-literal exposure of his client, and soon after, his personal data and those of his parents were uploaded to Doxbin.
Van Dyke then tweeted an apparent “bounty” (now deleted, although Motherboard has a screenshot) on the heads of nachash and fellow admin Intangir worth $10,000. That was “around the time he would have gotten his plain box full of horse shit” delivered to his door, nachash says.
Online to offline
Doxes have led to more than words and poo being thrown around. One common use of data is to employ it in “SWATing” a target, where a victim’s phone number is spoofed and used to call in armed police. The caller claims they need urgent assistance to the related address, officers arrive with guns drawn and surprise the victim.
One such was Robert Whitney, who was targeted by various SWATing pranks after his information was placed on Doxbin over an online scrap that started when he claimed to have discovered a security vulnerability in a coding site for the Python language.
He was added to the dreaded “proscription list”, which includes those who are targeted for special treatment.
Incident reports seen by the Guardian and confirmed by the Bloomington, Illinois police department show that officers were called to his house on numerous occasions. In one case, police were told that people were being held hostage at gunpoint. In another, someone pretending to be Whitney claimed to be a political activist threatening to kill hostages with nerve gas. In both cases, the officers soon learned what was up, releasing Whitney after he declined to speak.
Post-Onymous
As soon as Doxbin went down, site admin nachash leaked Doxbin’s logs in the hope that Tor researchers would scour the data to figure out how the police had seized the hidden sites.
For now nachash is not too worried about being caught. Could the police ever figure out who he is? “We never gave correct billing info and the money trail is a proper dead end, so we have zero concerns about being caught that way.”
One senses a sting in the tail, however. Doxbin is still alive. Intangir, a longtime collaborator, has the keys to the kingdom. Although the police were able to seize the domain, it is technically trivial to re-establish control of a “seized” site. And the Doxbin’s new overlord has simply set up a new domain that agents cannot touch.
The survival of Doxbin would indicate that hidden sites on the Tor network are very tricky indeed to keep down. David Mair, a doctoral student at Swansea University whose cyberterrorism project has been examining Tor-based services, says arrests are the only truly effective way to take out a dark web service.
“As these individuals haven’t been arrested, they still know the private key that controls what information is displayed on the website and crucially, are free to access it as they see fit,” Mair says.
ncG1vNJzZmivp6x7tbTEoKyaqpSerq96wqikaKyVmLWvu8uonrJnYmV%2BdXvDnppoaGlku6Kvx5qqoWWUpMWjtc1mm6iwXaS7rbXNng%3D%3D