$0$
$0$ (alternatively rendered as SOS) is a cyber-collective consisting out of threat actors operating within The Com, a decentralized ecosystem of interconnected internet communities notorious for cybercrimes. Originally established around late 2021-to-early 2022 as an informal friendship group, the collective subsequently developed an identity centered on digital investigations, doxing, and the examination of alleged misconduct within online subcultures.
The collective is mostly known for employing aggressive and intrusive intelligence-gathering methods, including the acquisition and analysis of emergency data requests (EDRs), telecommunications records, confidential medical information, skiptracing records and the alleged involvement of insiders at major technology companies and online platforms, including Apple, who are purported to facilitate unauthorized access to sensitive information.
Its activities are also associated with social engineering, whereby individuals are manipulated into disclosing sensitive information or granting unauthorized access to otherwise restricted resources. These practices have contributed to the collective's reputation for conducting invasive investigations that frequently extend beyond conventional open-source intelligence gathering. According to the collective's observed behavior and history, these practices are primarily directed toward individuals suspected of pedophilic behavior, sexual exploitation, extortion, and other forms of online misconduct, as well as members of rival subcultures and communities whom the collective considers deserving of scrutiny or exposure. Its approach is characterized by a form of extrajudicial digital vigilantism, in which investigative targets are selected according to the collective's own assessments of culpability, perceived wrongdoing, or reputational significance, rather than through established legal or institutional processes.
The collective also mainly focuses on eliminating Telegram channels and chats by terminating them, a terminology in The Com used to describe the action of banning specific content such as posts, accounts or channels/group discussions.
Social Dynamics and Argumentative Behavior
Members of $0$ are frequently characterized by their confrontational, sarcastic, and intellectually derisive approach to interpersonal disputes. Their argumentative conduct often involves combining moral criticism, situational irony, and deliberately provocative insults, frequently constructing hypothetical scenarios intended to expose perceived hypocrisy, contradictions, or inconsistencies in an opponent's behavior.
Rather than relying exclusively on conventional insults, certain members employ more elaborate forms of ridicule, using their perceived intellectual superiority, knowledge of historical controversies, and familiarity with community relationships to undermine the credibility of opposing individuals. These exchanges commonly involve references to a person's past conduct, questionable affiliations, alleged incompetence, or dependence on more influential figures for social recognition.
A recurring characteristic is the use of morally framed comparisons and sarcastic analogies, particularly when confronting individuals accused of exhibiting behavior inconsistent with their publicly professed principles. Members may deliberately contrast an individual's stated beliefs with their alleged actions, presenting the resulting contradiction through exaggerated hypotheticals, rhetorical questions, or dismissive commentary.
Internal Loyalty and External Relations: Despite their often antagonistic public interactions, members appear to maintain a comparatively cohesive internal social structure, displaying loyalty toward established associates while treating perceived adversaries with considerable hostility. Individuals regarded as hypocritical, pretentious, or excessively dependent on their associations with prominent community figures are particularly susceptible to ridicule. This includes people disparagingly described as larpers, cheerleaders, or opportunists attempting to manufacture reputations through borrowed influence.
Although these rhetorical practices are presented by participants as exposing moral or intellectual inconsistencies, their exchanges can also involve personal attacks, unsubstantiated allegations, and deliberate provocation. Consequently, the collective's argumentative culture is distinguished by a combination of selective loyalty, moralizing criticism, intellectual mockery, and aggressive social confrontation.
Summarized History and Timeline
The following timeline is compiled from the collective's Doxbin page and historical Telegram channels including their public archives, documenting events and activities they have claimed responsibility or joint responsibility for. Additional sources are referenced where available.
- 2021 – Founding of $0$: The collective is reportedly established by Rileigh, also known as Gothic, initially functioning as an informal online friendship group.
- April 22, 2022 – Establishment of Doxbin presence: The collective reportedly creates its first Doxbin profile, marking an early stage in its transition toward organized online documentation. During this period, no actual activity was documented.
- March 24, 2026 – Vari (Ven the Caller): $0$ publishes documentation concerning Vari, an online actor described by the collective as attempting to emulate the identity, reputation, and online persona of Ven764.
- April 15, 2026 – Court Saken Lilith (roY): The collective publishes material concerning Saken, also known as roY, whom it accuses of involvement in online extortion.
- April 27, 2026 – RevVs: $0$ documents RevVs, identified as a Minecraft server operator, reportedly following interpersonal disputes.
- May 8, 2026 – SaiMVK: The collective publishes allegations concerning SaiMVK, accusing the individual of inappropriate sexual conduct or intentions involving minors.
- May 18, 2026 – Devastationial VR Hands: The collective publishes a documentation entry concerning the online identity Devastationial VR Hands.
- July 6, 2026 – HexxedByMars: $0$ records an investigation concerning the online identity HexxedByMars.
- July 7, 2026 – BearCK, Hkay and MaRe: The collective publishes a joint documentation entry concerning three individuals operating under the respective pseudonyms. This documentation seems to primarly contain exposals of notorious com figures believed to be reputable.
- July 12, 2026 – Ezeclears: $0$ publishes documentation concerning the online identity Ezeclears.
- July 31, 2026 – Oddy OW: The collective adds Oddy OW to its documented subjects.
- August 27, 2026 – Mr Meow: $0$ publishes material concerning the online identity Mr Meow.
- September 3, 2026 – Noah 1800: The collective publishes a documentation entry concerning Noah 1-800.
- September 5, 2026 – Physical764: $0$ publishes documentation concerning the online identity Physical764.
- September 5, 2026 – Ray (Sickndpretty): The collective publishes material concerning Ray, also known as Sickndpretty.
- September 19, 2026 – FatherAE (Ryo764): $0$ publishes a documentation entry concerning FatherAE, also identified as Ryo764.
- September 24, 2026 – Keep101: The collective publishes documentation concerning the online identity Keep101.
- October 2, 2026 – Elite to Clique: The associated group account was given a promotion from Elite to Clique on the Doxbin site.
The collective's published Doxbin entries have amassed an estimated cumulative total of approximately 48,000 views across its documented publication history as of this article's publish date.
Conflict with BearAE
Shortly after a series of documentations concerning BearAE, coordinated and published by Rileigh on 12 September 2026, a broader controversy emerged involving allegations of concealed identities, historical affiliations, and purported connections to extortion-related organizations.
The initial publications primarily examined BearAE's alleged misconduct within the anti-extortion community, including his associations with controversial individuals, involvement with groups such as CultKillers and S.P.Y., and alleged use of coercive social-engineering practices. Rileigh circulated archived conversations, organizational rosters, and screenshots presented as supporting evidence, including messages purportedly acknowledging ethically questionable methods used against individuals targeted for removal from online communities.
Following these disclosures, BearAE reportedly responded with a series of allegations directed at Rileigh, also known as Gothic. These included claims that Rileigh had previously operated under the pseudonyms or collectives Fantasy717, Burnings, and Kaskar, alongside accusations identifying him as Emi/Empathy, an individual purportedly associated with the leadership of BloodCouncil, a group described as having participated in extortion-related activities.
The subsequent screenshots reveal considerable uncertainty surrounding these accusations. Conversations attributed to BearAE alternately suggested that Gothic was collaborating with Emi or was Emi himself. Other participants speculated about supposed connections between Gothic, Empathy764, and additional online identities, while circulating claims concerning shared accounts, impersonation, and allegedly concealed affiliations. One participant explicitly characterized the identification as a personal suspicion rather than an established fact.
The controversy was further complicated by archived interpersonal disputes, conflicting accounts from individuals acquainted with the parties involved, and allegations seemingly influenced by prior disagreements. Collectively, the material illustrates how speculation concerning pseudonymous identities developed into increasingly serious accusations without establishing a consistent or independently verified account.
By 16 September 2026, Rileigh's channel published forwarded statements expressing an intention to disengage from the ongoing conflict, followed by an announcement declaring the dispute concluded. Although the surviving correspondence documents the escalation and subsequent attempted de-escalation, the allegations concerning Rileigh's purported identities and involvement with BloodCouncil remain unsubstantiated by the available evidence.
In a subsequent development, $0$ reportedly released a document titled "FatherAE", drawn from the collective's previously maintained archives. The publication was described as a retaliatory measure, motivated by suspicions among $0$ members that FatherAE and BearAE were coordinating efforts against the collective. Believing that the two individuals were potentially conspiring to undermine or otherwise target the organization, $0$ allegedly authorized the document's release as a preemptive response to the perceived threat.
Associated Threat Actors
The $0$ collective has undergone several organizational changes since its establishment in 2021, evolving from an association of pseudonymous individuals into a more established group within the Doxbin community.
The collective reportedly transitioned from Doxbin's Elite rank to Clique status. Its contemporary membership is described as consisting predominantly of current and former Doxbin staff, particularly individuals associated with the platform's Council and Moderator positions.
Although $0$ maintains its own organizational identity, its reported overlap with Doxbin's moderation and council structure represents a significant characteristic of its contemporary membership.
Earlier Documented Members
- Rileigh (Gothic) — Founder and earliest identified member of the collective.
- Unidentified members — The identities and organizational roles of other individuals associated with $0$ during its earlier years remain undocumented or have not been independently established.
Currently Active Threat Actors
The following individuals are identified as the collective's currently active members, with their respective roles and areas of specialization described below. These areas of specialization are based on the group's publicly accessible archives, accounts and associated chat histories.
- Rileigh: Founder and principal administrator of $0$, reportedly specializing in the acquisition and analysis of telecommunications records, Emergency Data Requests (EDRs), and other forms of Closed-Source Intelligence (CSINT) data.
- Rifle: Member whose reported activities primarily concern telecommunications intelligence gathering, including the acquisition and examination of telecom records, EDR-related information, insiders, medical records and other CSINT data.
- Nenavidet: Primarily specializes in comprehensive Open-Source Intelligence (OSINT) and Social Media Intelligence (SOCMINT) investigations, investigative documentation, and structured information formatting. Particularly associated with TLO-based skip-tracing lookups, public court-record research, social engineering, and extensive SOCMINT investigations. According to limited sources, Nenavidet seems to have also upgraded their investigative capabilities to be able to obtain EDR-related information.
- Lace: Member reportedly specializing in CSINT investigations, particularly the acquisition and analysis of EDR-related data, while maintaining a solid ground in OSINT research.
- Pokidat: The collective's most recently inducted member, whose investigative activities reportedly focus exclusively on OSINT research and analysis.
