Days after an activist was doxed, thugs brutally attacked him outside his home. The site with information on him and more than 100 others is being spread by Chinese state media.

Lillian Suwanrumpha / AFP / Getty Images

HONG KONG — When Isaac Cheng saw three men standing near the door of his apartment on an evening in early September, he didn’t think anything of it. But when Cheng, 19, pulled out his keys and moved to open the door just as he normally would, one of the men swung his fist at his left eye. As Cheng’s glasses fell off, another man’s fist landed on the same eye. “Why are you doing this?” he asked. His face was swollen and scratched in a photo posted on Twitter.

Picture of Isaac Cheng’s injuries

The men, whom Cheng described as middle-aged and wearing gold chains, didn’t say much other than shout profanities at him. After a few minutes, a neighbor called out from a window and the men ran off, Cheng said.

The whole incident happened so fast that Cheng barely had time to process it. “I wasn’t thinking about anything,” he told BuzzFeed News. “It wasn’t until later that I realized it was probably for my role in the protests.”

Cheng is the vice chair of Demosisto, a pro-democracy organization led by Joshua Wong, a former leader of the 2014 Umbrella Movement and now part of the mass pro-democracy protests that have crippled Hong Kong for months. The attack against Cheng hadn’t come out of nowhere. In late August, Cheng saw his personal information — including his address, phone number, and Facebook accounts — listed on a website alongside those of other protesters. He shared a screenshot with BuzzFeed News. On Aug. 31, a day that one of the many weekend protests had turned violent, Cheng’s phone was flooded with phone calls. The same thing happened when Demosisto organized a student strike on Sept. 2, the first day of school in Hong Kong and the day Cheng was attacked. The calls were so frequent it was hard to use his phone. “They just wanted to block out any communication,” Cheng said. On another occasion, Cheng said someone had tried to access his Telegram account, but failed because he had two-factor authentication in place. Cheng believes the website that doxed him by publishing his personal information online was started by pro-Beijing supporters in Hong Kong. “I feel fear,” he admitted. His family, too, was scared and told him not to walk home alone anymore. But part of Cheng remains defiant as he considers the doxing website a component of a larger campaign to incite fear in protesters as mass demonstrations continue into their third month. “This is their strategy to use scare tactics to make Hong Kong people give up their freedoms,” he said of the Hong Kong government. “Feeling fear will restrict your freedom.” The website where Cheng originally discovered his details has been taken down. That site, along with a similar domain, were both associated with bad-actor IP addresses that had hosted cryptocurrency and phishing scams which had been mostly targeted at Russians, BuzzFeed News has found. Neither site had any identifying information aside from the IP addresses, making it difficult to know who was behind them. But a new version of the doxing site launched on Sept. 6 and is hosted on a Russian server. It’s already been blacklisted by DomainTools, an online investigative and risk assessment platform. The site remains live, but some of the traffic to it is being blocked, researchers at DomainTools told BuzzFeed News. The domains hosting the site are suspicious based on their online behavior, the researchers added, but there are no identifiers on who could be behind the sites.

Screenshot Screenshots of the original version of the doxing site as compiled on Telegram.

More than 100 people are listed as targets on the most recent doxing site — among them are activists that include Cheng, pro-democracy lawmakers, and local journalists. Versions of the website have become more sinister, with red targets appearing on protesters’ faces. And the number of people listed continues to grow, with more added this week. BuzzFeed News attempted to contact the host but did not receive a reply. The link was spread on social media in groups on Facebook, Telegram, and WeChat. Some of the accounts that spread the link on Facebook didn't appear genuine, using images instead of photographs as avatars and not showing friends lists or personal activity on their timeline. Facebook did not respond to questions about whether it had taken down posts linking to the site. Twitter also did not respond for comment on whether it had blacklisted the site to prevent the link from spreading. Reddit said “doxxing is not allowed on the site” and “oftentimes moderators of specific communities will take action” but did not specify if the site had been blacklisted. “Leak me I don’t care. Not scared,” said one member on the forum LIHKG, where protesters have been organizing, in response to the doxing site. Another post shared a sample letter so site users could report the website for violating its terms of service by encouraging harassment. On Wednesday, China state media published a video on Weibo about the website. “Take a look at those ugly faces,” said the post by CCTV. “Take off those masks and let’s act,” it added, calling for people to spread the post.

Weibo/CCTV