Cyberbullying, Harassment & Coordinated Attacks
One post is enough to start a campaign. Understanding how these campaigns work is the first step to surviving one.
The Post That Started Everything
Arjun managed social media for a regional news outlet in Hyderabad.
One evening, he posted a routine reply to a public figure's tweet - slightly sarcastic, nothing unusual. Within an hour, a prominent account with 200,000 followers quote-tweeted his reply with the caption: "Who is this guy?"
That was all it took.
By midnight, his employer's contact form had received 60 messages demanding he be fired. His home city had been found and posted. A private Discord server coordinated who would contact which of his family members. Someone called a fake police emergency to his neighbourhood address - a swatting attempt.
Arjun had made one sarcastic reply. The response involved hundreds of people, multiple platforms, and a real police call to his home.
He was not famous. He had no particular enemies. He had simply been visible at the wrong moment.
What Is Actually Happening
64%
of online harassment targets say it significantly affected their mental health.
26% reported that harassment moved from digital to physical - through their workplace, their address, or their family.
Source: Anti-Defamation League, Online Hate and Harassment Report, 202452% of Doxxing Victims Fear Physical Harm
Doxxing - publishing someone's personal information without consent - results in physical fear for over half of victims. Home addresses, workplaces, and family members' names are the most commonly published data points.
Swatting Incidents Up 1,000% Since 2015
Swatting - calling fake emergencies to a target's address - has increased dramatically, with schools, homes, and workplaces all targeted. Real emergency response resources are diverted. Victims have been injured during police responses.
Targeted Harassment vs. Pile-On Attacks
Targeted harassment comes from one person or a small group, sustained over time. It is personal, often involves someone the target knows, and typically follows the target across platforms.
Pile-on attacks are different in structure. A trigger event (a post, a video, a public reply) causes a larger group to converge on a single target simultaneously. Most participants do not know the target. They are responding to an instruction - a quote-tweet, a callout post - rather than a personal grievance. The scale is the weapon.
The pile-on is harder to defend against because there is no single actor to block, no single platform to report, and no clear end point.
Doxxing - What It Actually Involves
Doxxing is the act of researching and publicly publishing someone's private information. The information itself is often technically public - available through voter records, business registrations, LinkedIn, or data brokers. The harm is in the aggregation and amplification: individual pieces of information become a threat profile when combined.
Common doxxing sources:
- LinkedIn cross-referencing (employer, role, location)
- Voter registration databases (home address)
- Data broker sites (Spokeo, Whitepages, Pipl)
- WHOIS records for domain registrations
- Old forum posts or social media that includes location data
Swatting - The Physical Escalation
Swatting means calling emergency services with a fabricated report - a hostage situation, a bomb threat, a violent crime - at a target's address. Real armed police respond to a real address. The target has no warning.
Swatting is federal-level illegal in the US, and a criminal offence in most jurisdictions. Multiple people have been killed during swatting responses. It is not a prank.
How a Coordinated Campaign Unfolds - and Where to Interrupt It
The interactive below shows all five stages of a coordinated harassment campaign - from the initial flag to doxxing. Select each stage to see the platform mechanics being used and what to do at that point.
What That Just Showed You
1. Each stage uses specific, known platform mechanics. Quote-tweets amplify. Discord servers coordinate. Data brokers aggregate addresses. Knowing the mechanic means knowing where to interrupt it - and what to report to platforms beyond a standard harassment flag.
2. Doxxing uses public information. That does not make it legal. Courts in multiple jurisdictions have upheld that aggregating and publishing public information with intent to cause harm constitutes harassment and, in some cases, criminal threatening. The fact that data was technically accessible is not a defence for the person who weaponised it.
3. The person who starts a pile-on bears responsibility even if they do not participate directly. Pointing someone at a target ("Who is this?") and then stepping back while others attack is a documented legal and ethical concept in harassment law. Platforms are increasingly treating the initial amplification as coordinated inauthentic behaviour.
Three Things Worth Doing
1. Document before you block. Every block or report may cause content to disappear. Screenshot usernames, post URLs, and timestamps before taking any action. Documentation is what law enforcement and legal counsel need.
2. Report to platform trust teams using the right language. Use the words "coordinated inauthentic behaviour" in your report if multiple accounts are acting together. This routes your report to a different team than standard harassment reports. Platforms treat coordinated campaigns differently from individual posts.
3. If your address has been published, act on three fronts simultaneously. File a police report. Request data broker removal (DeleteMe, Kanary, or manual removal requests). Contact your local electoral authority about address suppression on public records. These three actions together address the immediate risk and reduce future exposure.
One Question Before You Continue
Arjun received coordinated harassment from hundreds of accounts after a prominent user quote-tweeted him. His home address was published in a Discord server. What is the most critical difference between reporting this and reporting standard harassment?