How to File a Complaint Against an Unknown Person Online in the Philippines: “John Doe” Complaints and IP Tracing

This is practical legal information, not a substitute for advice from your counsel.

1) Big picture

If you’re harmed online by an unknown person (e.g., harassment, threats, doxxing, cyber libel, sextortion, fraud), you can start a criminal, civil, or administrative action even if you don’t yet know the offender’s real name. Philippine procedure allows complaints against “John Doe”, while you use lawful processes to unmask the person through IP-based and platform disclosures.

2) Laws and rules you’ll rely on (at a glance)

Revised Penal Code (e.g., libel, threats, estafa) + special penal laws (e.g., RA 10175 Cybercrime Prevention Act; RA 9995 Anti-Photo and Video Voyeurism; RA 9775 Anti-Child Pornography; RA 10627 Anti-Bullying for schools; RA 11313 Safe Spaces Act—online GBSH; RA 9262 VAWC if intimate partner; RA 11934 SIM Registration Act).
Cybercrime Prevention Act (RA 10175): preservation/production of computer data, real-time traffic collection, and specialized cyber warrants.
A.M. No. 17-11-03-SC (Rules on Cybercrime Warrants):
- WDCD (Warrant to Disclose Computer Data)
- WICD (Warrant to Intercept Computer Data)
- WSSECD (Warrant to Search, Seize, and Examine Computer Data)
- EPCD (Expedited Preservation of Computer Data)
Rules on Electronic Evidence (A.M. No. 01-7-01-SC): authenticity, integrity, chain of custody for digital proof.
Data Privacy Act (RA 10173): allows disclosure to law enforcement/courts via lawful order; governs handling of personal data you obtain.
Mutual Legal Assistance mechanisms for foreign platforms/data.

3) “John Doe” complaints—how they work

What it is. You file a complaint-affidavit naming “John Doe” (or “Unknown Respondent”) when the offender’s identity is still unknown. You include all known identifiers: handle/username, profile URL, channel ID, email, wallet address, device fingerprints, timestamps, IP(s), screenshots, and links.

Why it’s allowed. Criminal complaints may proceed where the respondent’s identity is unknown at the outset; courts also issue warrants against a particular person or thing sufficiently described. The key is particularity: describe the account/activity so the person can be identified once data is disclosed.

When to amend. After you obtain subscriber or account data (e.g., from an ISP or platform), you move to amend the complaint/information to substitute the real name for John Doe.

4) Where to file and who can help

Criminal route (most common):
- File a Complaint-Affidavit with the City/Provincial Prosecutor (National Prosecution Service) where any element of the offense occurred, where the complainant resides (often used for libel), or where the computer system involved is located.
- Or lodge with PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division (CCD), who can investigate and then refer to the prosecutor.
Civil action: Damages (Civil Code Arts. 19, 20, 21; privacy under Art. 26), injunctions. You can also sue John Doe and later amend.
Administrative avenues:
- NPC (National Privacy Commission) for privacy violations/data breaches.
- Sectoral regulators (e.g., banks/fintech) for fraud-adjacent harm.

5) Evidence you should preserve before filing

Full-frame screenshots and screen recordings of the content and your reporting steps (include URL bar and system clock).
Source URLs and IDs (post links, channel IDs, message IDs).
Timestamps with time zone; keep a separate incident log.
Headers/metadata when available (email “Show original”, platform export).
Device and network context (your IP at the time, device used).
Financial records (receipts, transaction hashes, bank/GCash references).
Witness statements or affidavits.
Preservation requests: send platform law-enforcement preservation notices (your counsel/LEO should do this formally). RA 10175 allows expedited preservation.

Tip: Keep originals. Don’t alter filenames. Hash important files (e.g., SHA-256) and log hashes and dates.

6) The filing packet (criminal complaint)

Complaint-Affidavit (notarized): facts in numbered paragraphs; elements of the offense; harm suffered; basis for venue.
Annexes: evidence list with exhibit labels and hashes; screenshots; links; copies of platform notices; any reply tickets; bank/telecom certifications; your ID.
Reliefs sought:
- Referral to ACG/NBI for investigation if not engaged yet.
- Applications for cyber warrants (WDCD/WICD/WSSECD) and/or preservation/production orders to specific platforms/ISPs.
- Hold-departure/lookout assistance (for serious cases); protective orders for VAWC/child cases.
John Doe caption sample:

People of the Philippines v. John Doe (a.k.a. @Handle123, Profile URL: …, Channel ID: …), Respondent Criminal Complaint for [e.g., Libel under Art. 353 in relation to RA 10175]

7) Unmasking an unknown offender (IP & account tracing)

A. What data you can seek

Traffic data/logs (timestamps, IP addresses, ports).
Subscriber information (name, address, contact tied to an IP, SIM, or account).
Content data (actual messages/files—higher privacy threshold).
Device and login telemetry (user agents, device IDs, geolocation approximations).

B. How you lawfully get it

From platforms: via WDCD (warrant to disclose) or production orders/subpoena issued through the court/prosecutor; for foreign platforms, coordinate via ACG/NBI and DOJ-International Affairs/MLA channels.
From ISPs/telcos:
- Use WDCD or court-backed subpoena/production order for subscriber info behind an IP, CG-NAT port/time stamps, and CDRs.
- Preservation orders can compel ISPs to retain logs up to 6 months (extendible) while you pursue the warrant.
- SIM Registration Act records help map mobile numbers to registrants (obtained through lawful order).

C. Real-time vs historical

Historical IP and account logs: WDCD/production orders.
Real-time collection/interception: requires WICD (higher standard; typically for ongoing threats/extortion).

D. Cross-border data

Expect lead times; some providers disclose limited basic subscriber info to Philippine LEOs via established channels, but content or sensitive logs usually require MLA or letters rogatory. Start preservation early.

8) Procedure after filing

Docketing and evaluation by the prosecutor; a subpoena issues to the respondent (for John Doe, this awaits identification).
Preliminary Investigation (PI): you may be directed to supplement with new data (e.g., ISP certification) as unmasking progresses.
Applications for cyber warrants: your investigator or prosecutor files verified applications with the designated cybercrime courts (Regional Trial Courts) to compel data disclosure.
Amendment/substitution: once the real identity is confirmed, move to amend the complaint to replace John Doe and proceed.
Filing of Information in court, issuance of warrants of arrest or trial processes.
Parallel civil claim (optional): file for damages/injunction; you can later consolidate or simply proceed separately.

9) Venue and jurisdiction pointers

Venue is proper where any element of the offense occurred, where the libelous post was accessed by a third person, where the complainant resides (often accepted in cyber libel), or where the relevant computer system is located.
Cybercrime cases are typically heard by designated RTCs (special cybercrime courts).

10) Electronic evidence essentials

Authenticity: show how the screenshot/export was generated; keep original files; record hashes.
Integrity: maintain a chain-of-custody log (who handled the files, when, and how).
Best evidence for web content: full-page captures with URL/time, HTML/PDF exports, and where possible, server-side records obtained through warrants.
Witnesses: your affidavit + any corroborating witnesses (e.g., recipients of threats, moderators).

11) Timelines and practical tips

Act fast on preservation. Many platforms and ISPs have limited log retention; request expedited preservation while you prepare warrants.
Be specific. For each account or incident, list exact timestamps (with timezone), URLs, and identifiers; this precision lets ISPs map dynamic IPs behind CG-NAT.
Expect NAT/Proxy/VPN hurdles. Layer your requests (platform → ISP; multiple logins; payment trails; phone recovery numbers; device telemetry).
Coordinate early with ACG/NBI; investigators are familiar with provider playbooks and MLAT requirements.
Protect yourself. Consider temporary protection orders (VAWC), take-down strategies, and digital hygiene (password resets, 2FA, SIM swap safeguards).

12) Common offenses & elements (online context)

Cyber libel: defamatory imputation; publication to a third person; identifiable victim; malice (presumed for libel, with defenses).
Threats/extortion/sextortion: unlawful demand + intimidation; evidence often includes chat logs and payment trails.
Estafa/online fraud: deceit + damage; keep transaction proof.
Voyeurism/Non-consensual sharing (RA 9995): creation/distribution/possession of intimate images without consent.
GBSH (RA 11313): unwanted online sexual remarks, stalking, image-based abuse.
Child sexual abuse material (RA 9775): strict procedures; immediate report to authorities.

13) Minimal templates (you can adapt)

A) Preservation/Production language (for your counsel/investigator to tailor)

“Please preserve and subsequently disclose, pursuant to RA 10175 and the Rules on Cybercrime Warrants, all traffic data, access logs, and subscriber information for Account ID/URL ___, including login timestamps (UTC), source IP addresses and ports, user agents, recovery emails/phones, and payment instruments, for the period [YYYY-MM-DD HH:MM ±TZ] to [YYYY-MM-DD HH:MM ±TZ].”

B) Particulars section in a John Doe complaint

“Respondent John Doe is the controller of @Handle123 (Profile URL: ___; Platform Internal ID: ___). On [date/time], Doe posted [content] accessible at [URL]. Platform records and ISP logs corresponding to timestamps [list] are expected to identify the person controlling the account.”

14) Pitfalls to avoid

Vague time windows (ISPs can’t map IPs without precise time/zone).
Editing originals (destroys authenticity).
Assuming foreign platforms will disclose without proper channels (route through ACG/NBI and, when needed, MLA).
Over-collecting sensitive data yourself (risking privacy violations); let lawful orders do the heavy lifting.

15) Quick action checklist

Secure evidence (screens, URLs, IDs, hashes).
Write your incident timeline (UTC+08:00).
File/coordinate with PNP-ACG or NBI-CCD; send preservation requests.
Prepare John Doe complaint-affidavit with annexes.
Seek WDCD (and other warrants as needed) to get platform/ISP data.
After identification, amend to name the real respondent; proceed with PI and filing.
Consider civil remedies and safety/protection orders.

If you want, I can turn this into a filled-in complaint-affidavit template and an evidence log sheet you can reuse.