Basics Of Sock Puppets.
Disclaimer : This guide is for educational purposes and not for illegal activities.
Have you ever pulled a prank on your friends by creating a fake account? Well, for some of you it might have ended in giggles and for others a total disaster! In OSINT investigations, being able to create a flawless fake identity is a plus. These accounts are called sock puppet accounts. In order to investigate a particular individual or particular organisation, these fake accounts are super helpful.
Creating a sock puppet is an art, it’s not limited to particular entities, if you are smart enough, you can pull off the task targeting many individuals or groups with a single account. It depends on the situation, what you want to achieve and how well you build your identity.
If you want to build an effective sock account, it takes a while. Do not rush or get overwhelmed by time constraint. Patience is the key. So let’s look at some steps to build a fake online identity.
Choosing A Face
Face is everything. It’s the first thing that your target notices. You should not use the face that could be easily recognised, such as a celebrity, athlete, public figures and so on. Again it’s the matter of who your target is and what are you trying to achieve. Let’s say if you use a less known celebrity or local celebrity’s face from another country, there might be a chance that your target might believe you, but if he/she’s is technically woke, they can easily find out with a simple reverse image search. So it’s better to choose a face which is normal and looks legit. You can visit this person does not exist, where you can find a computer generated image of a person, who doesn’t exist in real life. If this doesn’t work for you, you can come up with your own strategies based on your region and requirements.
Personal Information
After you choose a face, your name, address, work profile should look solid. Basically, you are creating a character in a story and it’s your job to make it look real. You can use fake identity generator to get a fake name, address and other details. You can also fill in fake street name, work place and so on. But, that would be a risk as if those details doesn’t exist on the internet.
A Dedicated Email
It’s a common sense that you should have a separate email for your investigation. You can get free emails from ProtonMail, Tutanota, Mail.com etc.
Virtual Machine
It is always recommended to conduct your investigations in a virtual environments. If you cannot afford a separate laptop for your investigations, you can always use Virtual Box or VMware on your system.
VPN
VPNs or proxies are not necessarily required, as most of the sock puppets are used for social media investigation. It's hard to find your IP address. But, if you are conducting an investigation, where you don’t wan to leave any trial, VPNs or Tor Browser will serve you the best.
Final Words
Sock Puppets take time to build trust and achieve legitimacy. It's necessary to go slow and be steady all the time. Even an iota of doubt might ruin your investigation. You can be creative in your approach, social engineering skills come in handy. Now who are you going to catfish?
