Doxbin Staff

Record ID: GRP-0003
Type: Network / Collective / Organization / Crew
Status: Active / Intermittently Disrupted
Active Since: 2011

Summary

Doxbin Staff refers to the loose, pseudonymous operator, administrator, management, moderation, council, and helper network associated with Doxbin across its original Tor/onion era and later clearnet iterations. Doxbin is a doxing-focused paste platform used to publish personal information about targeted individuals. Public reporting describes the original Doxbin as a darkweb pastebin for personal information and notes that it was seized during Operation Onymous in November 2014. Later reporting on the clearnet version identifies internal user tiers including Admins, Manage, Mod, Council, Founder, Clique, Rich, and All Users.

The original Doxbin launched in May 2011 and is associated with the administrator/founder handle “nachash.” After Doxbin was seized in November 2014, reporting stated that nachash leaked site logs and that longtime collaborator Intangir retained control material for a successor domain. Later clearnet-era administrators claimed the current iteration began in early 2018 and was created by “kt” and “Brenton” as a replacement place to store doxes; that later history also claimed the site was no longer affiliated with nachash.

Public reporting and staff-index records indicate that Doxbin staffing is volatile, with frequent role churn across administrator, manager, moderator, council, and helper tiers. The current 2026 staff index lists CEO as an active administrator and manager; month as an active manager and moderator; Kaede, compression, and month as active moderators; and arabz, Kaede, hell, vuges/stiches, and compression as active council members. The same index marks several recently removed or demoted 2026 staff, including support, hardline, owl, Yosef, GalaxyArts, shy/repository, II, y6t, boss, InsaneCEO, vernal, cybermetabolic, 59, price, nissan, ave, kamie, apathy, sewer, and ck.

Later Doxbin staff/operator reporting links the staff network to several cybercrime-adjacent communities and incidents, including ViLE, LAPSUS$, Scattered Spider, The Com, fake emergency data request activity, swatting/doxing cases, and retaliatory breaches against Doxbin itself. Publicly reported or index-listed handles associated with Doxbin ownership, administration, moderation, or staff context include nachash, Intangir, kt/Kayte, Brenton, White/WhiteDoxbin, Anitsu/Miku/Everlynn, Weep, Ominous/Ominus/Convict, Operator, o, CEO, Admin/Batman, month, support, hardline, Kaede, compression, owl, Yosef, GalaxyArts, shy/repository, arabz, hell, vuges/stiches, and others listed below.

Only public handles, court-reported aliases, staff-index aliases, role contexts, dates, and non-sensitive status markers are recorded here. Private identities, addresses, phone numbers, personal emails, contact handles, dox links, direct Doxbin profile URLs, and leaked database contents are intentionally excluded.

Known Members

Current / 2026 Staff Index Snapshot

The following entries are taken from the 2026 staff index. “Active” means the row is marked with a check mark in the index. Dates in the final position are treated as resigned/demoted/end-date markers. Index-only entries should be treated as unverified OSINT unless independently corroborated.

2026 Council Entries

Historical / Publicly Reported Staff and Operators

Additional 2025 Index-Only Council / Helper Handles

These handles appear in the 2025 sections of the uploaded staff index, generally in council/helper roles. They are included as index-only references and should not be treated as independently verified.

(Only handles, aliases, role contexts, public index IDs, and non-sensitive role dates are listed. Contact fields, phone numbers, Telegram handles, direct Doxbin profile links, dox links, and personal information are intentionally excluded.)

Associated Groups

Timeline

Evidence

Ref Source Date Notes
[1] The Guardian — “The darkweb’s nihilistic vigilante sees the light” 2014-12-09 Describes the original Doxbin, the handle nachash, the May 2011 launch, the 2014 Operation Onymous seizure, and Intangir’s role in post-seizure continuity.
[2] DarkOwl — “Site Spotlight: Doxbin” 2024-06-15 Describes the clearnet Doxbin site, current-admin history claiming kt and Brenton created the current iteration in early 2018, user tiers, the moderator account “o,” and the disputed Operator incident.
[3] KrebsOnSecurity — “A Closer Look at the LAPSUS$ Data Extortion Group” 2022-03-23 Details White/WhiteDoxbin’s reported Doxbin ownership period, sale-back, and leak of the Doxbin dataset, and connects WhiteDoxbin to LAPSUS$ reporting.
[4] KrebsOnSecurity — “Hackers Gaining Power of Subpoena Via Fake Emergency Data Requests” 2022-03-29 Identifies KT as a past/current Doxbin owner in reporting and describes Anitsu/Miku/Everlynn as an old Doxbin staff member in the fake-EDR context.
[5] KrebsOnSecurity — “Two U.S. Men Charged in 2022 Hacking of DEA Portal” 2023-03-14 Reports that Weep and Ominous/Ominus were current/former Doxbin staff and connects KT/Kayte to Doxbin administration and ViLE-linked activity.
[6] U.S. DOJ EDNY — “Two Men Charged for Breaching Federal Law Enforcement Database...” 2023-03-14 Official DOJ release describing the ViLE case, aliases including Weep and Ominous/Convict, impersonation of law enforcement, and doxing/extortion conduct.
[7] U.S. DOJ EDNY — “Two Men Sentenced to Prison...” 2025-06-04 Official DOJ sentencing release for the ViLE-linked defendants associated with the aliases Weep and Ominous/Convict.
[8] KrebsOnSecurity — “The Dark Nexus Between Harm Groups and The Com” 2024-09-13 Places Doxbin and KT/Kayte within the broader The Com / harm-group ecosystem and describes Doxbin’s role in doxing, swatting, SIM swapping, and harassment dynamics.
[9] KrebsOnSecurity — “UK Arrests Four in ‘Scattered Spider’ Ransom Group” 2025-07-10 Reports Operator as a Doxbin administrator until recently and connects the handle to Scattered Spider/LAPSUS$-adjacent activity and the disputed May 2024 kidnapping narrative.
[10] Flashpoint — “Scattered Spider: A Threat Profile” 2025-08-15 / 2025-09-18 update context Describes Scattered Spider, Operator-linked aliases, prior Doxbin ownership/admin context, and charges connected to Operator-linked Scattered Spider activity.
[11] Cybernews — “Hackers clash over Doxbin lost account access” 2025-02-12 Reports on the TOoDA/Doxbin conflict, including claims of wiped accounts, admin lockout, leaked user data, and doxing of Doxbin administrators; notes later uncertainty over the scope of compromise.
[12] Hackread — “Doxbin Data Breach: Hackers Leak 136K User Records and Blacklist File” 2025-02-13 Reports TOoDA-linked claims of backend access and release of Doxbin user records and blacklist material.
[13] MSSP Alert — “Doxbin Allegedly Hit by Retaliatory Breach” 2025-02-13 Summarizes the alleged retaliatory Doxbin breach and notes attribution to TOoDA through vx-underground/Cybernews reporting.
[14] Uploaded current Doxbin staff index 2026-05-12 Lists staff by year/rank, including 2026 administrator, manager, moderator, and council rows; records IDs, aliases, join/promoted/resigned/demoted dates, active check marks, flag notes, and the index author’s caveat that the roster is a rough estimate. Contact fields and direct profile links were not reproduced in this record.

Notes

This record spans multiple Doxbin eras and should not be read as claiming one continuous staff roster from 2011 to present. Current staffing is volatile and often based on aliases, self-claims, hostile claims, court-linked reporting, third-party security reporting, and staff-index records. Treat the member list as a sourced OSINT snapshot, not a verified present-day roster.
The 2026 staff index uses a check mark as an active/status marker and dates in the resigned/demoted column as apparent end-role markers. The same index states that it is a rough estimate of staff service and that [X2] indicates a return or second staff period.
Some index rows contain inconsistent dates, duplicated IDs, repeated aliases, incomplete status fields, and conflicting 2025/2026 placements. Where conflicts exist, this article prioritizes the 2026 section for present-day status and treats older-year sections as historical context.
Private identity data, addresses, phone numbers, personal emails, contact handles, direct Doxbin profile links, leaked datasets, and dox links are intentionally excluded.

Record created: 2026-05-12.
Last updated: 2026-05-12.