kim-online-doxxing — paste-site + social amplification doxxing
J. Kim — PII (home address, employer, phone, family members) published to pastebin and amplified by 14 accounts across X and Telegram · URL chain traces to a threat actor with prior doxxing history · AI chatbot multi-account correlation links the amplifier accounts. Post-event triage. Fully synthetic.
what this proves
- every primary engine produces deterministic, fixture-locked output — verified by
npm run check:flagship(8/8). - every output is generated 100% locally in your browser — no upload, no server-side processing of your evidence.
- the full case binder is built from these outputs without uploading a single byte — click below to generate it locally.
primary engines locked to this fixture
build the case binder
one click runs all primary engines on the synthetic evidence, assembles findings into a self-contained html binder, and opens it in a new tab. print to pdf from there — still zero upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic, safe to attach to a PR or send to a reviewer. Compare your local runs against the published goldens.
built deterministically from scripts/fixtures/build-kim-online-doxxing.mjs. seed: kim-online-doxxing:v1.
methodology
doxxing post-event triage starts with scope, not attribution. use the doxxing victim kit to map every field of exposed PII and every platform it appeared on before you begin any actor tracing. the IOC extractor pulls the paste URL chain; the URL unshortener reconstructs any redirect hops; the AI chatbot multi-account correlator links the 14 amplifier accounts to a prior doxxing actor cluster. preserve all screenshots with timestamp metadata before requesting takedowns. read the full online doxxing (post-event triage) guide →
after the playbook
export findings from each primary engine, then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timeline across paste publish time, amplifier repost chain, and takedown request dates — still zero upload.