Aurora Johnson

Plunging the Internet Toilets: The Illicit Economy Enabling High-Tech Harassment, Stalking, and Sextortion in the Sinosphere

Across an increasingly Balkanized global internet, within myriad digital enclaves across the globe divided by regulations, language barriers, great firewalls, and filter bubbles, one universal trend seems to unite the digital world– the formation of sadistic online cesspools focused on sexploitation and harassment. In this talk, we will focus on “internet toilets” (互联网厕所) which are toxic online communities where Chinese netizens can dox their enemies and exes and collaborate with others to conduct aggressive cyberbullying and harassment campaigns. These Chinese internet toilets have strong similarities to western doxing communities and sadistic harm groups.

Internet toilet users often purchase data and technical services to enable targeted harassment and stalking. We will go over some of the tools and services marketed to doxers, stalkers, and harassers on Chinese darknet marketplaces across three main categories: personal data lookup services which are often serviced by corrupt insiders with positions in public security and technology companies, digital harassment tools such as SMS bombardment services, and sexploitation tools like AI nudify apps. Because some of this activity is occurring on monetizable social media platforms, harassers and internet toilet admins can also get paid simply for making popular posts that get a lot of engagement. In many cases, this doxing and harassment escalates to physical violence and has even driven victims to suicide.

This talk will introduce internet toilets, examine the various services and tools that service these cesspools, discuss the economic and social incentives that drive this behavior, and compare and contrast Chinese internet toilets to Western doxbins. More broadly, we will assert how digital gender-based-violence acts as a core motivator and monetary driver of cybercrime across the globe.


Aurora Johnson is an information security researcher and cybersecurity policy expert with experience working in both the public and private sectors. She is currently the Manager of Security Research Partnerships for SpyCloud Labs. Prior to joining SpyCloud, she worked as a Senior Analyst for the Cybersecurity and Infrastructure Security Agency (CISA). Aurora participates in a range of volunteer and public-private initiatives to track and disrupt cyber threat actors; she was a recipient of the President’s Volunteer Service Award in 2023 for work with the U.S. government to combat cybersecurity threats. She holds both a BS and MA from Georgetown University’s School of Foreign Service.

LABScon-2025_HeadshotFilter-Johnson_Aurora