The other half of not getting doxxed: your identity, not your address

I wrote about picking a shoot location without doxxing yourself: what's in the frame, what the window shows, what the file's metadata carries when you upload it. All of that is about the content.

But almost nobody gets found through their content. They get found through their account.

The leaks that actually unmask performers are boring and administrative. A handle reused from a hobby forum in 2014. A recovery email that's a variant of the real name. A profile photo cropped from a picture that still exists, publicly, in a tagged album on someone else's page. A payout account, a mailing address on a piece of merch, a phone number that ties two personas together in someone's contacts app.

None of that is in the frame. All of it is a straight line from the persona to the person.

Think of it as one rule

Every leak I've seen comes down to the same thing: a single object touched by both lives.

An email address that both personas used. A phone number both accounts verified with. A photograph that exists in both places. A username that's unique enough to be searched. A payment instrument. A physical address.

That's the whole model. You don't need a threat-intelligence mindset or a hardware token. You need to be able to answer, for each thing your persona touches: does the real me touch this too? If yes, that object is a bridge, and bridges get walked in both directions.

The specific bridges, in the order they bite

The handle. If your performer name — or any variation of it — has ever been used anywhere else by you, assume it's searchable. Handles are the cheapest thing in the world to search across platforms, and people do it as a reflex. Pick something with no history. Check that it has no history, including the version with a number after it.

The email. A dedicated address, from the beginning, that has never been the recovery address for anything in your real life and never will be. The failure I see most is a persona email whose recovery contact is the personal email, which means one password reset flow quietly connects them forever.

The phone. Same logic and more dangerous, because phone numbers are the connective tissue of every contact-sync feature ever built. A number that has touched your real identity, then gets used to verify a performer account, can surface you in "people you may know" to strangers. Use a separate number.

The photos. This is the one people underrate. Reverse image search is instant and free, and it doesn't care that you cropped your face out — it will match a bedspread, a tattoo, a background, a shirt. Before a photo goes onto a persona account, run it through a reverse search yourself and see what comes back. If a picture of yours exists anywhere in your real life — a tagged photo, an old profile, a dating app — do not reuse it, adjacent to it, or from the same shoot.

The money. Payouts land somewhere real. That's unavoidable and it's fine; the point isn't to be untraceable to a bank, it's not to be traceable by a subscriber. Watch for the places where a payment name leaks outward — some payment rails show a legal name on a transaction, and merch or custom-content shipping puts a real address in a stranger's hands.

The writing. Softer, real. People have distinctive verbal habits, and if your performer account and your real account have both posted 10,000 words, a determined person can notice. I don't lose sleep about this and I mention it because the determined person is exactly the one you're worried about.

Self-monitoring, not just prevention

The part nobody does: check yourself on a schedule.

Once a quarter, search your own performer name the way a stranger would. Reverse-search your own published images. Search your real name plus the word "OnlyFans" and the platform names. Look at what actually surfaces.

This is unpleasant and it takes twenty minutes and it's the only way you learn about a leak while it's still small. Most doxxing stories I've heard go the same way: the person found out from somebody else, well after it would have been cheap to fix.

What the goal actually is

Not invisibility. You can't have that, and chasing it will paralyse you into never publishing.

The realistic goal is friction: making the connection expensive enough that a bored subscriber, a hostile ex, or a family member who half-suspects, doesn't get there with a casual search. Determined, resourced, targeted attention is a different threat model and it needs different advice than a blog post.

But most doxxing isn't an investigation. It's an accident — a reused handle, a recovery email, a photo that reverse-searched. Those are all preventable on a Sunday afternoon, before you publish anything, and they get vastly harder to fix after.

Do the audit before you need it. Every object your persona touches: does the real you touch it too?

— Sly