The Field Guide
Doxxing, untangled
Four different words get used for one fear. Doxxing, swatting, IP-grabbing, and harassment are not the same thing, and telling them apart is most of the protection. Here is what each actually is, what your game already does about it, and what genuinely keeps a person safe.
Ask how to stay safe from “getting doxxed” and you get a wall of advice, most of it aimed at the wrong problem. Almost all of the confusion comes from one thing: four separate problems wear the same name.
Separate them and most of the fear turns into a short, practical checklist.
Four words, one fear
When someone says they are worried about being doxxed, they usually mean one of four different things. They range from an insult in chat to the rarest and gravest case, and the defense for each is different. That distinction is the whole map.
Publishing someone's private, identifying information (real name, home address, workplace, phone) to expose or intimidate them.
The exposure itself. Everything below can follow from it.
Making a false emergency report so that armed police are sent to a target's home. It uses the address, not the internet, as the weapon.
The gravest and rarest. This is the one that has killed.
Obtaining the network address a player is connected from, usually to locate them roughly or to flood their connection.
Largely a legacy problem. See the folklore check below.
Sustained abuse, threats, or brigading aimed at a person. It needs no private data at all, only an audience.
By far the most common of the four.
The sizes are worth holding onto. On Twitch, whose own H1 2025 report publishes the numbers, harassment enforcement outnumbered private-information enforcement by more than twenty to one. The loudest fear, doxxing leading to swatting, is real and it is the rarest. The most common harm is ordinary harassment, which needs no private data at all. Aim your effort where the risk actually is.
Swatting, and the case that changed the law
Swatting is the gravest rung because it turns a false phone call into an armed response at a real door. The reason it is taken seriously today, in courts and in police departments, traces to one night that has to be told plainly.
A dispute over a $1.50 wager in an online Call of Duty: WWII match led one player to ask a serial hoaxer to swat the other. The target gave a false address he no longer lived at, and a hoax call reported a shooting and hostage situation there. Police were sent to the home of Andrew Finch, 28, a father of two with no connection to the game or the dispute. He came outside, and an officer shot and killed him on his porch.
The caller was sentenced to 20 years in federal prison, which the Department of Justice believed to be the longest sentence imposed for swatting or hoax calls. The player who asked for it was sentenced to 15 months in prison and banned from online gaming for two years.
What matters for a reader today is what the case built. Kansas passed an anti-swatting law months later. Police departments began the address registries described below. And Wichita reached a $5 million settlement with Finch's family. A death that should never have happened became the reason the protections that follow exist.
The part that is mostly folklore
The most repeated fear, “anyone in your lobby can pull your IP,” is the one that has aged the worst. It was true, in a specific era, and the sweeping version aimed at the games most people play now is not backed up by the public record.
In older peer-to-peer titles, where one player's machine hosts the match, every player's address really was visible to the lobby, sometimes listed outright by third-party tools. That is a documented reality of legacy games, and it is where the “grab your IP” lore comes from. The lesson survived; the architecture that made it true mostly did not.
Modern Call of Duty runs its online play through Demonware, Activision's own networking studio. Exactly how a given current title or mode handles player addresses is not something the public record spells out plainly, and that cuts both ways: the sweeping claims that a modern title leaks your address, or worse, quietly installs software or steals passwords, also trace back to single unverified posts, and they blur three different things into one scary sentence: an address, a crash, and code running on your machine. Treat a claim like that the way this guide treats any other: ask for the source before you act on the fear.
The exposure is real in old peer-to-peer games and thinly evidenced in new ones. The defenses below work either way, which is why they are the answer instead of the panic.
What your game already does for you
Start with the protection you already have and may not have turned on. The best of these earns its place by being honest about its own limits.
The strongest protection is the one you never have to switch on. When a platform ships restrictive defaults, a stranger cannot look you up unless you have opted in to being found.
Example. In January 2021, Activision changed Call of Duty account privacy so profiles defaulted to blocking third-party stat lookups. Trackers now work only for players who set their data to public themselves.
For anyone broadcasting live, the exposure is the username in the killfeed. Streamer modes hide it, so opponents cannot tell which match a creator is in and cannot follow them into it.
Example. Call of Duty's Warzone Streamer Mode hides other players' names, and Raven has tested a “Streamer Mode Plus” that also replaces the streamer's own in-game name with a random one.
The most complete version lets you hide your own identity from strangers and hide theirs from you, cutting lobby-based lookups on both sides. It is honest about its edges, which is what makes it trustworthy.
Example. Riot's Streamer Mode hides your Riot ID from non-party players and can replace everyone else's name too. Riot states plainly what it does not cover: your friends list, and your match history.
The honesty is the feature. Name-hiding protects the live match, not the permanent public record, and Riot says so rather than letting you assume more.
The streaming platform can carry protection the game cannot: a blocked-terms filter you can load with your own details, clear rules against posting anyone's private information, and fast human and automated moderation.
Example. Twitch's anti-doxxing guidance lets a streamer add their own personal details to a blocked-terms list to reduce the chance they are shared in chat, prohibits all doxxing, and points at-risk users to the defenses below. The filter helps rather than guarantees, since it matches set words and can be worked around.
What genuinely protects you
These four are the ones that hold up when you check them against a real study, an official page, or the legal record, rather than against folklore. They are ordered from the highest-value habit down.
Most doxxing is not a hack. It is a search of the data brokers who already sell your name, address, and relatives. Opting out of those databases removes the raw material.
The surprising part. In a controlled Consumer Reports study, doing the opt-outs yourself by hand removed about 70% of listings within four months, beating every paid removal service tested, which averaged only about a third.
It is ongoing hygiene, not a one-time fix. There is no federal opt-out right, and data can reappear, so it is a habit rather than a switch.
Some police departments let a resident who fears being swatted flag their own address in the 911 system, so a hoax hostage call is met with caution instead of a raid.
Example. Seattle's police department built an anti-swatting registry in 2018; dispatchers see a “swatting concerns” note when a call comes in for a registered home. Twitch now recommends at-risk creators contact their local 911 to ask whether one exists where they live.
A gamertag tied to nothing personal is hard to trace. The leaks are usually the reused username, the linked social profile, and the real name attached somewhere in the chain.
The practice. Use a game handle that is not your everyday username, turn on the streamer and privacy modes above, and check what your account exposes across linked platforms.
A VPN masks your home address so that anyone who does grab your connection endpoint gets a datacenter, not your street. It is one honest tool, not a shield against everything.
Where it helps. On older peer-to-peer games where addresses are visible to the lobby, a VPN hides your real one.
On games that run on the publisher's own servers, there is no lobby IP to hide in the first place, and a VPN does nothing about a data-broker search. Right tool, specific job.
The law is catching up
Doxxing was long hard to prosecute for a specific reason: older harassment and stalking laws require a repeated course of conduct, and threat laws require an actual threat, and a single act of publishing someone's information need not be either. That gap is what newer state laws are written to close.
The picture is genuinely state by state. According to the Council of State Governments, as of mid-2025 only three states, Alabama, California, and Illinois, named doxxing as a standalone crime, while others address it by amending existing harassment or stalking statutes. The federal record makes the seriousness plain on its own: the 20-year Wichita sentence remains the anchor. The point for a target is simple. This is a crime with real penalties, worth reporting, not a prank to shrug off.
How this entry is written
This is a reference about a subject where real people have been harmed. It follows the same rules as the rest of the Field Guide, with extra care.
- The record, with dignity. The one death here is named because it is a matter of extensive public and court record, and it is told plainly, never for effect. We do not dramatize a person's worst day.
- A reference, never a how-to. We describe what each threat is and how to defend against it. We never explain how to find, expose, or attack anyone.
- Sourced, and honest about folklore. Every load-bearing claim links to a public source. Where a widespread fear is thinly evidenced, we say so instead of repeating it.
The thread under all of it: proving how you played should never require exposing who you are or where you live. That is the line the whole Field Guide is built along. If you came here from a crashed lobby instead, the companion entry untangles that one too.
- Wichita swatting, sentencing and case record: DOJ (Barriss) · DOJ (Viner) · case overview and settlement
- Activision default privacy change (Jan 2021): GamesRadar+ · account settings: Activision Support
- Warzone Streamer Mode / Streamer Mode Plus: Game Rant
- Call of Duty's networking backend: Demonware (Activision)
- Riot Streamer Mode, anonymizing your Riot ID (best-in-class, with stated limits): Riot Games Support
- Twitch anti-doxxing tools and transparency figures: Twitch Safety · H1 2025 Transparency Report (Twitch self-reported)
- Data-broker removal effectiveness (manual opt-outs beat paid services): Consumer Reports study
- Police anti-swatting registries: NBC News (Seattle)
- Doxxing and swatting law, state and federal: Council of State Governments · National Association of Attorneys General
Vera Project. “Doxxing, untangled.” Vera Field Guide (Field Note). The Vera Project. https://www.veraproject.xyz/field-guide/doxxing