Someone Posted My Address Online: Doxxing Help in Malaysia

Someone has posted your home address online. It might be a Facebook post naming your street, a TikTok video with a pin on a map, or a comment thread sharing your IC number and phone. Strangers can now see where you live, and you want it gone.

The short answer: if there is any threat to you or your family, go to the police first. Then save the evidence, report the post to the platform as private information or doxxing, and ask Google to remove search results that show your address.

This guide covers each of those steps for Facebook, Instagram, TikTok and Google, what Malaysian law now says about doxxing, and what to avoid while you wait. It is general information, not legal advice.

Last checked: 5 October 2026.

#What Should You Do If Someone Posts Your Address Online in Malaysia?

Put your safety first: if the post includes a threat, or people have turned up at your home, contact the police straight away. Next, record the link, take a screenshot that shows the date and the post, and note the poster's username. Report the post on the platform where it appears, choosing the private information, privacy or doxxing option. Ask Google to remove any search result that shows your address. Then make a police report, because doxxing became a specific offence in Malaysia on 11 July 2025. The platform and Google decide what is removed, and nobody can promise a removal.

#If You Feel Unsafe, Start With the Police

A doxxing post is often meant to frighten you. Sometimes it is a step towards something worse. If the post or the comments under it suggest anyone should visit, hurt or harass you, treat it as a safety matter first and a content problem second.

• If you are in danger right now, call 999 and tell the operator someone has published your address with a threat.
• If there is no immediate danger, go to the nearest police station and make a report. Bring the links, screenshots and usernames from the checklist below.
• Tell the people you live with, and your building security or management if you have them, so they know not to let in anyone they do not expect.
• If you can, stay somewhere else for a few nights until you know more. Your safety matters more than how quickly the post comes down.

Our guide to making a police report about online harassment explains what to bring and what happens after you lodge it.

#Is Doxxing a Crime in Malaysia?

Yes. The Penal Code (Amendment) Act 2025 came into force on 11 July 2025, according to the Prime Minister's Department legal affairs media release. The release says the amendments add new sections 507B to 507G on cyberbullying, and that spreading personal information without consent, known as doxing, is now treated as a serious crime carrying up to three years in prison.

The gazetted text of the Act (Act A1750) sets out the doxxing offences. Section 507G defines identity information as any information that identifies or purports to identify a person.

What this means for you: a police report about a doxxing post now has a specific offence to point to. It does not mean every post that mentions where you live is a crime. The police investigate, and the courts decide. If you are thinking about a civil claim, for example an injunction, speak to a lawyer. This article is general information, not legal advice.

#Save the Evidence Before You Report

Posts get deleted and accounts get renamed, sometimes within minutes of a report. Record everything first, then report. Our guide to collecting evidence before reporting harassment goes deeper, but this is the minimum.

• The full link to the post, video, comment or story. On a phone, use Share, then Copy link.
• A screenshot that shows the post, your information in it, the poster's name and the date. Include the phone's clock or the post's timestamp where you can.
• The poster's username and profile link, plus the display name, which can change.
• Links to every reshare, duplicate post or group where it has spread.
• Screenshots of any threatening comments or messages, with the sender and date.
• The Google search result link, if your address shows up in Search.
• Every report reference number, confirmation email and platform reply, with the date you received it.

#How to Report the Post on Facebook, Instagram, TikTok and Google

Report the post on the platform where it appears, and report the account too if it exists mainly to target you. The menu labels below can vary by app version, language and region.

#Facebook and Instagram: What Meta Removes

Meta's privacy violations standard is unusually specific about addresses. It removes content sharing the full private residential address of another person, including a building name or a pin on a map, even when the address sits behind an off-platform link. It also removes posts asking others for someone's private home address. Partial addresses and photos of the outside of a home can also come down in some cases, for example when they are shared to organise a protest against the person living there.

There are exceptions. Meta says it may allow information that has become public through news coverage, court filings or press releases, and it allows addresses shared to find a missing person or contact a business. The standard also covers national identification numbers and personal contact information shared without consent, which matters if the post lists your IC number or phone.

On Instagram, the help page on exposed private information names private address or location information, national identity numbers and non-public phone numbers. Instagram says it can only act when the information belongs to the person reporting it, or when it receives documents showing the reporter is authorised to act for that person. For photos and videos, a parent can report for a child under 13. It cannot remove information posted somewhere other than Instagram or Threads. The page suggests asking the person to take the post down, but only consider that if you feel completely safe doing so. If there is any threat, do not contact the poster at all.

#TikTok: Home Address Is High Risk Information

TikTok's privacy and security guidelines list home address, identity numbers, account login information and sensitive payment information as high risk personal information, and say TikTok does not allow content with personal information that could lead to stalking, identity theft, fraud or other harm. That applies even when the person once posted the information themselves.

Its safety and civility guidelines define doxing as publishing or threatening to publish personal information about someone online with malicious intent, and say TikTok uses signals such as captions and hashtags to judge that intent. Contact details and date of birth count as moderate risk information, which TikTok says it may remove when shared without consent, usually with more context. Explain in your report why the post puts you at risk.

#Google Search: Removing the Result, Not the Page

If your address appears in Google results, Google has two routes. Its page on removing private information from Search covers addresses, phone numbers, email addresses and confidential government ID numbers. It also has a doxxing route for pages that pair your personal information with explicit or implicit threats, or that gather a large amount of your personal information without a legitimate purpose.

1. Copy the link of each page that shows your address. Google reviews only the links you submit.
2. Use Results about you from your Google Account, or search your name, open the three dots beside the result and choose to remove it. Google says some of these features are still rolling out by market, so use the removal request form if the option is missing.
3. Add screenshots if the form asks for them. Google says they help it find the content.
4. Watch for Google's email. Approved results may be removed entirely or only from searches containing your name.

Two limits to know. Google weighs public interest, so it may decline to remove content it considers newsworthy. And removing a result from Search does not delete the page: the post is still online until the platform or website owner takes it down. Our guide to removing personal information from Google Search covers that route in more detail.

#Report to MCMC Under the Online Safety Act

The Online Safety Act 2025 has been in force since 1 January 2026, according to MCMC's page for the Act. Its First Schedule lists content that may cause harassment, distress, fear or alarm through threatening, abusive or insulting words or communication as harmful content. Section 24 lets you report harmful content to MCMC whether or not you have already reported it to the platform, and also covers content found elsewhere online.

MCMC's make a complaint page points to its complaint portal at aduan.mcmc.gov.my, and its table of agencies sends property or life threats to the Royal Malaysia Police (PDRM). In practice: report threats to the police, and use the MCMC portal for the content itself, attaching your links and platform reference numbers. If your details were leaked in bulk to a channel rather than in a single post, see our guide on a Telegram channel leaking personal data.

#What Platforms Usually Leave Up

Be prepared for some reports to fail. Platforms look at whether the information is private, whether it identifies you, and whether the post is likely to cause harm. These are the situations where a report is weaker:

• The post names only your town or general area, not a street or building.
• The information is your business address, or contact details you published yourself for work.
• The address appeared in news coverage or court documents that are already public.
• The post was reported by someone other than you, on a platform that only acts on reports from the person concerned.

A rejected report is not the end. Check whether the platform offers a review of its decision, add any new context such as threatening comments, and keep the police and MCMC routes open.

#What Not to Do

• Do not post the poster's name, address or workplace in return. Counter-doxxing can put you on the wrong side of the same law.
• Do not try to unmask, hack or trace the account behind the post. Leave identification to the police.
• Do not ask friends to mass report the post or file reports that exaggerate what it says. One accurate report with evidence is what the platform needs to review it.
• Do not argue with the poster in the comments. Replies keep the post active and draw more attention to it.
• Do not delete your own messages or posts that show the history of the dispute. The police may need them.

#Protect Yourself While Reports Are Reviewed

• Set your social profiles to private for now and check what your bio, tagged photos and check-ins reveal about where you live.
• Turn off location sharing on your phone's camera and social apps so new photos do not carry your location.
• Turn on two-factor authentication on your email and social accounts. Doxxing can come with attempts to get into your accounts.
• If your IC number was posted, watch for fake accounts, loan applications or messages using your name, and warn your bank if anything looks wrong.
• Set up alerts in Google's Results about you, if available to you, so you hear about new results showing your address.

#When a Case Review Makes Sense

Most people can do everything above on their own, and the official reports and the police are the routes that matter. AwareXone, our recovery and content removal service, can help when the post has spread across several platforms, when reports keep being rejected, or when a fake account in your name is part of the attack. We review the case first, use only the platforms' official privacy and harassment processes, and tell you honestly when we think a report will not succeed. We never ask for your passwords or login codes, and the platform makes the final decision. Our content removal page explains what we handle, and our Trust Center sets out how we work.

#Frequently Asked Questions