AnonIB Evidence Guide: How to Document Posts Safely Before Removal

Discovering that your photograph, name, private information, or intimate content may have appeared on an AnonIB-style forum can trigger an immediate reaction: delete everything, block everyone, and get the page taken down as quickly as possible.

Removal is important, but taking a few careful steps first can preserve information that may later help a platform moderator, victim advocate, lawyer, school, employer, or law-enforcement officer understand what happened.

Good AnonIB evidence is not a large collection of downloaded images. In most situations, the most useful record includes the exact page address, account details, dates, threat messages, report numbers, and enough surrounding context to show how the abuse occurred.

This guide explains how to document an AnonIB post safely, what information to preserve, what not to download, how to organize repeated incidents, and when professional help may be needed.

Why Should You Preserve Evidence Before Requesting Removal?

Anonymous posts can disappear without warning. An uploader may delete a thread, a platform may suspend an account, or a copycat website may suddenly go offline. Once that happens, important identifying details can become more difficult to recover.

Evidence may help with:

• A platform takedown request
• A search-result removal request
• A cybercrime report
• A school or workplace complaint
• A restraining-order application
• A civil legal claim
• A report involving sextortion or stalking
• Identifying patterns across several accounts
• Showing that a deepfake or impersonation campaign is coordinated

The Australian eSafety Commissioner advises people experiencing serious online abuse to preserve evidence before blocking an account or deleting messages. Useful details include the platform, exact URL, usernames, profile addresses, dates, times, and information showing the wider pattern of abuse. Its evidence-collection guide was updated in May 2026.

Preserving evidence does not mean you must postpone urgent safety action. If a post includes your home address, credible violence, stalking information, or a threat against a child, contact the appropriate emergency or law-enforcement service immediately.

What Counts as Useful AnonIB Evidence?

The most useful evidence answers five basic questions:

Question	Information to record
Where did it happen?	Website, app, group, forum, or messaging service
What was posted or threatened?	A brief factual description without unnecessary detail
Who was involved?	Usernames, profile links, email addresses, phone numbers, or payment accounts
When did it happen?	Date, time, and time zone
What happened afterward?	Reposts, threats, harassment, reports, or removal responses

One screenshot rarely tells the entire story. A threat may look harmless when separated from earlier messages. A username may change. A post may be part of a longer pattern involving several accounts.

Your evidence should therefore capture context without creating more copies of harmful material than necessary.

Start With Immediate Safety

Before documenting anything, ask whether viewing or collecting the evidence could place you in greater danger.

Contact emergency services or law enforcement if:

• Someone has posted your current address
• You have received a credible threat of physical harm
• A person appears to be tracking your location
• Someone is threatening to approach your home, school, or workplace
• A child is being sexually exploited
• The offender has access to your accounts or devices
• You believe your device is being monitored
• You are at risk of harming yourself

If you live with or know the suspected offender, using your normal phone or computer may alert them. Consider contacting a trusted person or professional from a safer device.

The Cyber Civil Rights Initiative Safety Center recommends considering physical safety before moving to evidence collection, removal, or legal action.

A Safe Order for Documenting an AnonIB Incident

You do not need a perfect investigation. Concentrate on the information that can disappear most quickly.

1. Record the Exact URL

Copy the complete address of the page, post, thread, profile, or file location.

A homepage address is usually not enough. Moderators and investigators need the specific location where the harmful material appeared.

On a mobile app, look for:

• A share icon
• “Copy link”
• A three-dot menu
• “View post”
• “Open in browser”

Paste the address into a private evidence document. Check that it has not been shortened or cut off.

If several copies exist, give each URL a separate entry.

2. Record the Website or Platform Name

An AnonIB-style page may use a familiar name while operating on an unrelated domain. Record both the name displayed on the page and the actual domain shown in the address bar.

Do not assume that a page is connected to the original AnonIB forum. Copycat pages can imitate branding, layouts, and forum categories.

The AnonIB mirror and copycat guide explains why supposed archives should be treated cautiously.

3. Capture the Username and Profile Information

Record any visible:

• Display name
• Username
• User ID
• Profile URL
• Account creation date
• Avatar
• Biography
• Connected account
• Contact address
• Payment identifier

A display name alone may not be reliable because it can be changed or copied. A profile URL or numeric user ID can provide stronger context.

Do not attempt to hack, track, or expose the suspected uploader yourself.

4. Note the Date, Time, and Time Zone

Record when you discovered the material and, if visible, when it was originally posted.

Include the time zone. A timestamp such as “8:14 PM” can become confusing when the website, victim, and investigator are in different countries.

A useful entry might look like:

Found on September 13, 2026, at 8:14 PM UTC. The page displayed a post date of September 12, 2026.

Do not change your device clock to match the website.

5. Capture the Surrounding Context

A screenshot should show enough information to establish:

• The platform or website
• The username
• The post or threat
• The date and time, where available
• The full browser address
• Relevant surrounding messages

Avoid cropping the only original screenshot so tightly that the source becomes unclear. You can make a cropped working copy later while preserving the original.

If a conversation contains many messages, document the sequence rather than capturing only the most disturbing line.

How to Take Screenshots Without Losing Important Details

Screenshots are helpful when they preserve context. They are less useful when the page address, date, account name, or surrounding conversation is missing.

For a web page, try to include:

• The entire browser window
• The address bar
• The post
• The visible username
• The timestamp
• The page title

For a messaging conversation, include:

• The contact or account name
• Several messages before and after the threat
• Visible dates
• Any request for money or additional content
• Any account, wallet, or payment information provided

Do not edit the original screenshot. Keep one untouched version and create separate copies if you need to blur personal details for a platform report or school complaint.

Screenshots may contain location information, contact details, notifications, or unrelated private conversations. Review what is visible before sending a copy to anyone.

Do Not Download Sexual Images of Minors

This is the most important evidence rule.

If an image or video sexually depicts someone who was under 18 when the material was created, do not download it, forward it, email it to yourself, print it, or ask another person to send it as proof.

Instead, record:

• The exact URL
• The platform
• The username
• The time and date
• A non-graphic description
• The location of the post or message
• Any related threats

The eSafety Commissioner specifically warns people not to screenshot, possess, create, or share sexualized content involving someone under 18. Its reporting guidance says that URLs, profiles, and usernames can be used to identify the material without creating another copy.

NCMEC also states that people should not download or ask someone to forward an explicit image merely to use its Take It Down service. The file should already be present on the device where it was originally created. Take It Down’s official FAQ explains this restriction.

In the United States, suspected online child sexual exploitation can be reported through the NCMEC CyberTipline. Other countries maintain their own child-protection and cybercrime reporting systems.

Documenting Sextortion Threats

Sextortion evidence often appears across several channels. An offender may begin on a social platform, move to a private messaging app, and then request money through another service.

Preserve:

• The full conversation history
• The offender’s account details
• The original contact request
• Threatening messages
• Payment demands
• Account or wallet details
• Phone numbers and email addresses
• Dates and times
• Voice messages
• Missed-call records
• Notifications showing deleted messages
• Reports submitted to the platform

Do not pay to create evidence. Do not send another image to keep the offender talking.

Once the necessary information is preserved, stop engaging and block the account when it is safe to do so. Read the AnonIB sextortion response guide for the next steps.

Documenting Doxxing and Personal Information

When an AnonIB-style post contains private identifying information, record exactly what was exposed.

This may include:

• Home address
• Phone number
• Email address
• Workplace
• School
• Family names
• Social profiles
• Vehicle information
• Daily schedule
• Live location
• Financial information

Do not repeat the exposed information in every report. State that the post contains private contact or location details and provide the exact source URL.

If an address is accompanied by threats or instructions encouraging someone to approach you, treat it as an immediate safety matter.

The AnonIB doxxing guide includes additional account-security and physical-safety steps.

Documenting a Sexual Deepfake

A fabricated image can still support a report involving image-based abuse, harassment, impersonation, defamation, or sexual exploitation.

Record:

• The manipulated image’s location
• The account that posted it
• Captions claiming it is real
• Comments identifying the person
• Requests to buy, trade, or redistribute it
• Threats connected to the image
• The original non-intimate photograph, if you already possess it
• Other copies using the same source photo
• Evidence showing when the original photograph was published

Do not upload the original photograph to an unknown “deepfake detector.” Such services may retain uploaded files or produce unreliable results.

A professional assessment may be useful in a legal case, but a platform report usually does not require you to prove exactly which AI tool was used.

See the AnonIB deepfake and fake-nude removal guide for more targeted help.

What If You Only Heard About the Post?

Sometimes a friend says they saw an image, but you do not have a link.

Do not ask them to forward the intimate material. Ask for non-graphic information instead:

• Where did they see it?
• What was the account or group name?
• Do they still have the page URL?
• When did they see it?
• What identifying details accompanied it?
• Did anyone threaten or contact them?
• Was it a direct message or public post?

Ask the witness to write a short factual account while the memory is fresh. They should avoid guessing about who posted it or whether the image is authentic.

If the person can safely copy the URL without saving or redistributing the content, that address may be enough to begin a report.

Create an Evidence Log

An evidence log keeps repeated incidents organized and prevents you from having to reopen upsetting material every time you make a report.

Entry	Date and time	Platform	Account	What happened	Evidence saved	Action taken
001	Sept. 13, 8:14 PM UTC	Example platform	@username	Threatened to post image	Message screenshots	Report submitted
002	Sept. 13, 9:05 PM UTC	Example forum	User ID 1234	Posted personal details	URL and page screenshot	Host contacted
003	Sept. 14, 7:30 AM UTC	Search engine	N/A	Result appeared for name	Result URL	Removal requested

Give every screenshot, PDF, or message export a matching entry number. Use neutral filenames such as:

• Evidence-001-Message.png
• Evidence-002-Forum-URL.pdf
• Evidence-003-Platform-Reply.pdf

Avoid putting graphic descriptions, passwords, or exposed addresses in filenames.

The Cyber Civil Rights Initiative recommends using an evidence chart to organize incidents and presenting the most recent and most serious events clearly when seeking assistance.

Store the Evidence Privately

Evidence files can contain highly sensitive personal information. Treat them as confidential records.

Consider these precautions:

• Use a device the suspected offender cannot access
• Protect the device with a strong passcode
• Store files in an encrypted location
• Use a unique password for cloud storage
• Enable two-factor authentication
• Remove evidence from automatically shared photo albums
• Turn off family or household file sharing
• Do not place evidence in a public folder
• Keep an additional secure backup
• Limit access to trusted people who genuinely need it

If your account may have been hacked, change its password from a trusted device before uploading evidence there.

Do not store the only copy on the same phone that may be lost, seized, damaged, or remotely accessed.

Preserve Original Files

Keep original screenshots, message exports, voicemails, and emails unchanged.

Avoid:

• Drawing on the original screenshot
• Renaming contacts before capturing the conversation
• Deleting earlier messages
• Changing file dates
• Combining several screenshots into one image
• Applying filters
• Converting everything repeatedly between formats

You may create redacted copies for reports, but retain the unedited originals.

If a case may involve court proceedings, a lawyer or digital-forensics professional can advise whether additional technical preservation is appropriate.

Save Emails in Their Original Form

An email screenshot shows what the message looked like, but the original email can contain additional technical information.

Keep the email in your account when safe. You can also use the provider’s export or download-original feature if you know how to do so.

Preserve:

• Sender address
• Reply-to address
• Recipient
• Subject
• Date and time
• Attachments
• Full conversation
• Delivery-failure notices
• Security alerts

Do not open unexpected attachments merely to identify their contents. A supposed AnonIB leak notification may be a phishing or malware attempt.

Record Every Report You Submit

Evidence collection should include your attempts to get help.

For each report, save:

• The date submitted
• The service contacted
• The category selected
• The URL reported
• The text of your request
• The confirmation number
• Automated emails
• Human replies
• The date content was removed
• Any appeal or follow-up

This creates a clear timeline if a platform does not respond or the same material reappears.

In the United States, the FTC says certain covered platforms must remove validly reported non-consensual intimate content and known identical copies within 48 hours. This includes real, digitally altered, and AI-generated content. If a covered platform lacks a working process or fails to respond as required, the issue can be reported through the FTC’s process. FTC guidance explains the current rules.

For a complete reporting template, use the AnonIB takedown-request guide.

Should You Contact the Uploader?

Usually, direct confrontation creates more risk than value.

Contacting an anonymous uploader may:

• Warn them that evidence is being collected
• Encourage them to delete or move the content
• Trigger more threats
• Reveal your contact details
• Confirm that they found the correct person
• Lead to additional harassment
• Draw you into negotiation or payment demands

If communication is necessary, consider getting advice from a lawyer, victim advocate, school official, employer, or law-enforcement officer first.

Do not threaten to hack, expose, or physically harm the person. Those messages may complicate later reports and place you in danger.

Should You Use an Internet Archive?

Do not upload intimate material to an archive service or create public archived copies yourself. Doing so can preserve content that you are trying to remove and may expose it to additional people.

If a historical copy is genuinely important for legal action, ask a qualified professional about the safest method of preservation.

The fact that a supposed AnonIB page calls itself an archive does not make it legitimate or safe.

When to Speak With a Lawyer

Legal advice may be especially useful when:

• The uploader is anonymous
• A website refuses removal
• The abuse is repeated
• You need a restraining order
• A perpetrator is stalking or blackmailing you
• Your employer or school is involved
• A platform may possess identifying logs
• You have experienced measurable financial harm
• You are considering a civil claim
• You are unsure how to handle sensitive evidence

A lawyer may advise sending a formal preservation request asking a platform to retain relevant account records and logs. This does not automatically give you access to the information, and platforms may require valid legal process before disclosing user data.

Do not send improvised legal threats if you are unsure what they mean. A victim-support organization or qualified lawyer can help you choose an appropriate approach.

Common Evidence-Collection Mistakes

Saving Only the Image

Without a URL, username, date, or platform, it may be difficult to establish where the file appeared.

Cropping Out the Address Bar

The harmful post may be visible, but the source cannot be identified.

Blocking the Account Too Early

Blocking may hide or delete the conversation before essential information is preserved.

Asking Friends to Forward the Content

This creates more copies and can be particularly dangerous when a minor is depicted.

Posting Evidence Publicly

Publishing screenshots to “expose” the offender may reveal the victim’s identity and increase attention.

Editing the Only Copy

Annotations, cropping, and filters can remove important context. Keep an untouched original.

Collecting More Than You Can Safely Handle

You do not need to search every suspicious forum yourself. Ask a trusted person or professional for assistance if the process becomes overwhelming.

Waiting for Perfect Evidence

A URL, username, threat message, and date may be enough to begin a platform or police report. Do not delay urgent safety action because your records feel incomplete.

Frequently Asked Questions

Should I take a screenshot before reporting an AnonIB post?

If it is safe and lawful, capture the URL, username, date, time, and surrounding context before submitting a removal request. Do not screenshot sexualized content involving someone under 18.

What if the post disappears before I document it?

Record what you remember, the approximate date, the platform, usernames, witnesses, notifications, browser history, and any messages referring to it. Avoid inventing missing details.

Is a screenshot accepted as legal evidence?

Screenshots can be useful, but legal requirements differ by jurisdiction and case. A lawyer or law-enforcement officer can explain what additional authentication or preservation may be required.

Should I download an AnonIB video as evidence?

Do not download questionable or illegal content. If the video involves a minor, do not save or forward it. Record its location and seek professional guidance. Adults considering legal action should ask an advocate or lawyer what preservation is appropriate.

Can I blur an image before sending it to a platform?

You may create a redacted copy to protect privacy, but keep the original evidence unchanged when it is legal and safe to possess. Some reporting systems may only need the post URL rather than a copy of the image.

What evidence is useful for an anonymous uploader?

Profile links, user IDs, timestamps, post URLs, messages, payment demands, email addresses, phone numbers, and connected accounts may all help. Do not try to identify the uploader through hacking or public doxxing.

How long should I keep the evidence?

There is no universal period. Keep it while reports, investigations, legal deadlines, or reupload concerns remain active. A qualified professional can advise you based on your location and circumstances.

Should I preserve negative messages that make me look bad?

Do not selectively alter a conversation. Preserve the complete relevant exchange when safe and lawful, then let your lawyer or advocate help explain the context.

Collecting AnonIB evidence should be a controlled process, not a search for every copy on the internet. Start with safety, record the source, preserve the surrounding context, protect the original files, and move toward reporting and removal.

If the material involves a child, do not download or redistribute it. If threats, stalking, hacking, or blackmail are involved, get specialist help rather than confronting the offender alone.

A clear URL, accurate timeline, preserved message, and organized evidence log will often be more useful than a folder filled with unnecessary copies of harmful content.