Someone Posted My Address on X: How to Report Doxxing

A stranger has posted your home address on X. Or your personal phone number, a photo of your ID, or the name behind your anonymous account. Replies are piling up and you do not know who has seen it. This is frightening, and the first thing to think about is your physical safety, not the post.

This guide follows X's Help Center pages as they read today. It covers what X counts as private information, what it does not, who can report, the form options, what X can do, and a safety checklist. One wrong step can cost you the account, so know what you are doing before you start, especially before you reply to the person who posted it.

Last checked: 29 October 2026.

#Quick Answer: How Do You Report Doxxing on X?

X's Private information policy says you may not threaten to expose, encourage others to expose, or post other people's private information without their express permission. Report the post through X's normal reporting flow, which the Report abusive behavior page describes: select the more icon on the post or profile, select Report, and choose who the report is for, such as Myself. X also has a Private Information form.

#What X Counts as Private Information

The policy splits information into what you cannot share without permission and what X does not treat as private. This table puts the two side by side.

The policy also bans threatening to expose someone's private information, sharing details that would let others hack into someone's accounts, offering or asking for a reward to post someone's private information, and asking for a reward in exchange for not posting it, which X calls blackmail. It says screenshots of messages are not a violation unless they contain private information such as someone's phone number.

#What If It Was Already Public Somewhere Else?

This part of the policy matters if your details were already online. The policy says that if information was shared somewhere else first, such as someone putting their own phone number on their public website, X may not treat it as private. It then adds an important exception: X may take action against home addresses being shared even if they are publicly available, because of the potential for physical harm. X also says it considers physical location and phone numbers to be higher risk than other types of information, and that it looks at why the information was shared, acting where it believes the intent is abusive or to harass.

#Who Can Report It

The policy says anyone can report private information when it has been shared in a clearly abusive way. When it is not clear, X says it may need to hear directly from the owner of the information or an authorised representative, such as a lawyer, before taking action. So a friend's report can help, and filing your own report as Myself means X hears from you directly. For photos and videos of you, X's Right to Privacy section says it needs a first person report from the person shown or a representative such as a parent, legal guardian or lawyer, and that this part of the policy does not apply to public figures.

#Two Ways to Report on X

1. From the post or profile: select the more icon, select Report, and choose Myself. The report page says X then asks for more information and may ask you to select more posts from the account. It says one report can include several posts.
2. By form: open X's Private Information form. When we read it, the form asked What issue are you having, with Private content is being posted as an option, and then who the content belongs to: Me, Someone I am authorized to represent, or Someone else.
3. Report the account as well as the post if it exists only to post people's details. X's policy lists suspension for accounts whose sole purpose is to post others' private information.
4. Keep the report confirmation. The report page says it may take up to 24 hours to appear.

When we opened the form in a desktop browser on 29 October 2026, it loaded normally and showed these two questions. If it does not load for you, use the report option on the post instead.

#Safety First Checklist

These steps are our own suggestions, not X instructions. Do them in the order that fits your risk.

• Screenshot the post with the account name, date and link visible before you report. Posts can disappear once reported.
• Tell the people you live with what was posted, so nobody opens the door to a stranger without checking.
• If your phone number was posted, expect scam calls and messages, and do not share codes or passwords with anyone who calls.
• If an ID document was posted, note which document it was, so you can tell your bank and the issuing office if needed.
• Check your own accounts for old posts or photos that show your home or routine, and limit who can see them.
• If the post includes a threat, take your screenshots to the police and say it was posted publicly.

Our guide on making a police report for online harassment in Malaysia explains what to bring. For the legal position on doxxing in Malaysia, see our guide to online harassment law and the Online Safety Act.

#What X Can Do and What It Cannot

The policy lists the enforcement options: X may require the person to remove the post and spend a period in read-only mode before they can post again, with account suspension possible for repeat violations. It may also suspend accounts whose sole purpose is to post others' private information or media. The person can appeal if they believe X got it wrong.

X cannot unshare what people have already seen or saved. The report page also says X does not release account information except as required by valid legal process, so if you need to know who is behind an account, that goes through the police or a lawyer. You can block the account, but X's blocking page says blocked accounts can still see your public posts.

#What Not to Do

• Do not post the other person's details in return. That breaks the same policy and can get your own account restricted.
• Do not pay anyone who offers to delete the post for you through a contact at X. X's pages describe only its own reports and forms.
• Do not message the person who posted it with threats or demands. Keep everything as evidence instead.
• Do not give your X password or a login code to anyone helping you report.

#What the Pages Do Not Say

• They do not give a time for X's decision, only that the confirmation may take up to 24 hours.
• The policy page does not set out an in-app click path specific to private information, so we have described the general report flow.
• They do not cover copies of the post on other sites. Our guide on removing a doxxing post with your address covers other platforms and search results.
• They give no Malaysia specific steps.

#When It Is Safer to Get Expert Help

The steps above come first, and you should start there. It gets harder when your details spread across several accounts, when information was already public elsewhere and X does not see it as private, or when the person keeps reposting from new accounts. A report that does not show why the information is private may not lead to action, and anyone promising instant removal for a payment is not using X's routes.

If you are unsure how to show X that your information is private, or the post is spreading, having an experienced team handle it is the safer choice. AwareXone helps people document doxxing and file through X's official routes. See our content removal help, or apply for a case review.

#When a Case Review Makes Sense

A review helps when your details are posted on several platforms, when you are a public facing person who is a repeat target, or when reports have been closed without action. SocialSafe by AwareXone is a Malaysia-based service, independent of X, that works only through X's own reports and forms. We never ask for your password or login codes, and X makes the final decision. Read how we work on our trust page.

#Frequently Asked Questions