Doxxing is the malicious publication of private, identifying information about a person — home address, workplace, contacts — typically to harass, intimidate, or endanger them. It often uses the same open-source techniques as legitimate investigation, which is exactly why intent and restraint matter.
The line between OSINT and doxxing is not the tool but the purpose: legitimate work serves a lawful, proportionate goal and respects privacy, while doxxing weaponises public data to cause harm.