What is "Opening the Box"?#
"Opening the box" refers to the illegal online search and excavation of personal privacy information, which is then published online, leading to public condemnation of the person being "opened." "Opening the box" is an upgraded version of "human flesh search," shifting online disputes to offline harassment, undermining public order and morals, crossing legal boundaries, and causing significant mental stress and personal harm to victims. Behaviors like "opening the box" may violate the Criminal Law. In response to this chaos, the internet administration has repeatedly launched targeted rectification actions under the "Clear and Bright" series.
Regardless of your technical knowledge, if you live in mainland China, all the content of this article should become everyone's "common sense." You may not need to know, but you cannot afford to be ignorant. In the era of "opening the box," personal privacy is truly important; do not easily hand over the power to be harmed to others...
You will learn how to "open the box," but my intention is not to teach you how to "open the box" on others.
The Incident of Baidu Vice President's Daughter, Xie Andy, "Opening the Box"#
Related reading: The Daughter of Baidu's Vice President Turns Out to Be an Online Welfare Girl—A Dual Warning of the Collapse of Elite Family Education and Cyber Violence
A 13-year-old girl "opened the box" on a pregnant woman from a fan circle who had been arguing with her, and within just two days, she put Baidu and her father in the spotlight. Xie Andy claimed that the "opening the box" information was provided by her father, who is a vice president at Baidu, flaunting proof of employment and his annual salary...
There were too many elements involved, and the points of contention were numerous, leading to a sudden explosion of news. After studying the circulated screenshots, it was found that the "opening the box" information did not come from her father; it should have been searched by herself on TG.
Latest development: Xie Andy's entire family registration has been exposed.
How Does "Opening the Box" Happen? Main Ways of Information Leakage#
Archive Checking, Information Brokers, and Insiders#
The preferred method for "opening the box," and the most direct, stable, and efficient method in the black industry related to information security: finding archive brokers. Small brokers focus on individual orders, while large brokers sell in bulk. These brokers operate across major social media and gray areas, buying off insiders from various internal systems and platforms, collaborating long-term or sharing profits per order, allowing them access to very sensitive data and information sources.
Different information brokers have their own areas of expertise; it can be said that as long as you find the right person, no matter how sensitive the information is, it can be obtained. Therefore, this method is extremely powerful and deadly:
First, the clues provided by the "opening the box" party are more flexible. They are no longer limited to the victim's phone number, ID number, WeChat ID, or name; they can even just provide a photo for the insider to perform facial recognition, obtaining the entire family registration and high-definition headshots of the target.
Second, the information that can be "opened" is rich in content and dimensions. From basic household registration information to commonly used delivery addresses; from hotel check-in records to real-time mobile phone locations; from educational background, school, and graduation time to bank account numbers under their name. It can be said that everything that can be digitized is basically obtainable if one is willing to pay.
What's even more deadly is that this method of leakage is extremely difficult to prevent; it cannot be completely avoided just by being cautious about privacy protection.
Recommendation: Under any circumstances, try not to fill in real information. If you choose to upload data, be prepared for it to be made public and have countermeasures in place.
Do not overly trust any official sources to protect your uploaded data...
Social Engineering Databases and Data Leakage#
Directly query key information from databases leaked from various platforms and ready-made social engineering databases. Nowadays, social engineering databases are truly diverse; free social engineering databases can show various household registration, delivery, and bank card information. Of course, this is just the tip of the iceberg; paid databases are even more outrageous.
Some people even publicly share social engineering databases. After all these years, very few domestic vendors have admitted that their platforms have experienced data leaks. However, looking at the current social engineering databases, the sheer number and accuracy of the information are a slap in the face.
Who leaked this data? Don't the vendors have any idea? They just pretend to be dead, only issuing PR statements and continuously denying it. A simple search in a free social engineering database can expose you thoroughly.
For example, some free social engineering databases linked to QQ, Weibo, and phone numbers can reveal other two pieces of information if you know one. Some databases even allow you to input any number without caring about which platform it belongs to, directly matching and revealing all accounts associated with it.
Generally speaking, there are no convenient solutions to this. It is recommended to completely change leaked phone numbers, emails, QQ, and other contact information to distort and expire the exposed data.
Human Flesh Search#
Mobilizing the public to participate in human flesh searches and hunting. Generally, these are people who are known or can access information and data, who do not seek economic benefits but actively expose others' information on social platforms.
For example:
Certain celebrities' passport photos and videos or images from their computer hard drives have been shared online.
Some women's contact information has been sold by acquaintances, and they have even been slandered and subjected to yellow rumors. (Refer to the news in the related links at the end of the article)
Such cases of retaliating against others by exposing information are very common.
For instance, in the following case:
The female protagonist's phone number was posted on an anonymous platform, claiming she was offering low-priced tutoring in a southern region, and then her phone and WeChat were bombarded with messages.
However, the female protagonist lives in the north, and the content in the image is clearly inconsistent with the facts. The cost of such rumor-mongering is very low; it only requires fabricating some eye-catching false narratives to cause trouble for the person, and it can even lead to substantial harm.
Here, I would like to remind all sisters:
Never take nude photos! Never film sex videos! Never believe what the other party says about "not posting online"!
If all else fails, absolutely do not show your face!!!
Such explicit photos and videos have long occupied the top positions on various adult websites, and it is not surprising that the female protagonist is often "opened" by others.
Human flesh searches are indeed difficult to prevent; however, the target group for human flesh searches is very limited. If you haven't offended someone you know or encountered bad luck, the likelihood of an ordinary person being "opened" is actually not high.
Registered Accounts#
Use registration query websites to check registered accounts. For example, REG007, knowing a phone number or email allows you to check all registered websites and apps, thus continuing targeted attacks through information retrieval.
Currently, REG007 seems to require registration, so it is not recommended for use.
Privacy Settings in Applications#
Through WeChat, Alipay, QQ, etc., add contacts and search by phone number, email, ID, etc. By cross-referencing information across multiple platforms, verify whether the information you have is consistent or confirm key clues for further attacks.
This method has the lowest cost, but many people overlook its destructive potential, ultimately becoming passive accomplices in "opening the box."
Personal Homepages on Social Platforms#
Directly search on personal homepages across major social platforms. If you habitually upload your real information to social platforms, others may follow the information you post to find out your birthday, birthplace, residence, name, school, etc. Many middle-aged and elderly people like to use their real information online to easily find acquaintances. This can easily attract the attention of black industries, such as archive checking and telecom fraud.
Information Retrieval and Data Mining#
Unintentional exposure can also become a key clue for being "opened." This method can sometimes be quite deadly. For example, by querying the EXIF information of publicly posted images and inferring from the text, one can deduce information such as addresses.
A well-known case is that of a security expert who taught people how to bypass firewalls; due to leaked key information in blog images, he was detained by national security and has not been released for many years.
How to Conduct Human Flesh Searches and Methods for "Opening the Box"#
You need to use Telegram, click to use the search bot, search for the keyword "opening the box," and you can find a wealth of methods for "opening the box" and checking archives!