When someone says sock puppets, maximum people will think something like this.
And yes originally they are called sock puppets.
But sock puppets have different meaning in technical and OSINT world.
What is sock puppets?
Sock puppets are nothing but detailed created fake social media accounts to research in OSINT without giving up the true identity.
Sock Puppets are basically aliases, fictitious persona profiles created by someone else with specific goals in mind and is part of an OSINT Social Engineering technique.
These type of accounts can be used by anyone like investigators, detectives, hackers, police, journalists, it can be anyone who wants to impersonate someone else.
Now you will thinks like – yeah that’s an easy job like you just have to create a fake account.
Well, it’s not as easy as it sounds, for creating a successful sock puppet it needs to be credible and consistent with how the real person behaves online. Sock puppets have a real name, real phone numbers, address, photographs, credit card number, various social media accounts, friends, etc.
So, now we know what sock puppet is. let’s see what is the purpose of the sock puppets
Purpose of Sock puppets.
Sock puppets can be used in various different ways-
- Investigators can use the sock accounts to collect information and do research o some cases.
- Hackers can use sock accounts to do social engineering on the target to collect the information.
- Detective can use these type of accounts to collect information and to know the nature of someone related to their cases.
Basically, sock accounts are used to collect information or to look into someone without letting them know. Anyone can use it in anyway they like.
What does it takes to make a perfect sock puppet?
A perfect sock puppet will never be connected by any means to its original owner.
To anonymize the account so that it doesn’t log your original IP address or location, You have to use VPN or TOR while creating the account.
Another Best way to do it is to connect to any public Wi-Fi to create an account. Make sure you always log in to that account with the same network. Never ever use your own IP address to create sock accounts.
According to TraceLabs creating a Sock on Facebook is the most difficult thing because Facebook uses to flag your account if you use TOR or VPN services.
Choosing a Right Platform
Choosing the right platform to create the account is also important. If you are creating sock puppets for Indian user’s you have to do research on what social media is mostly used in India. And make sure to create an account on those.
Instagram, Facebook, WhatsApp, Signal are one of the most used social media in India, so make sure you have an account on these.
Make it as much real as possible
Your account should look legit and real.
To make your account more legit and real try to use it for long terms.
For example, Create account (which we will discuss how to create in few seconds) and use it for like 3 to 4 months with daily posting something, following someone making online friends. So that your account looks real enough to be trusted.
Now we know the basic component of Sock Puppets let’s see how to built one.
How to Create Sock Account?
1. Name
For account we need a name.
https://www.fakenamegenerator.com/
From fake name generator you can create a person that never have existed with Name, address, mother’s Maiden name, Address, Email address, weight, height, credit card, date of birth, favorite color, vehicle number and all sorts of information you need to be that person.
One More Important Thing
Of course you can be any person but try to be a female person, because female accounts gets attraction soon.
https://www.elfqrin.com/fakeid.php
You can also use the elfqrin(above link) to create a fake user with lots of details.
Now we have name and every information of fake person.
Email Address
Now you have name and all sorts of details, you need a email address matching to that name.
You can use any mail provider to create email address make sure not to use your IP address while doing this.
Email providers
- Gmail.com
- Yahoo mail
- Proton Mail
- Mail.com
I recommend using mail.com to create email address and make sure you don’t use existing email address.
Now we have email address.
Face
Now we need a face for image verification
https://thispersondoesnotexist.com/
You can get a face from the above link just refresh the website until you are satisfied with your face.
This website create fake faces with AI so the faces created by the website do not exists in real world. so you can be one.
Now we have all the important ingredients to create account
What are Burner Phones and Sim Cards?
Burner means to use and through or a phone that is not connected to you in any way. A hone or a sim card that you will only use for the sock account and nothing else.
Burner Phone and sim cards are only important when you are into Deep OSINT for Basics a Sock Account is enough for Active or Passive investigation.
But When a website needs to verify your phone number then it’s good to have burner sim cards.
Although you always have options to buy a VoIP number or the cheapest sim card for mobile verification.
This is it. Now you can create your own Sock Account.
Do Socks account have to be some person?
That’s a very good question if you get it in your mind.
Answer to this is “NO”. Socks account don’t have to be a person.
You can make a fan page or meme page grow it and use it for researching.
For Example– You can make an account named robert_downey_fans or something like this and you can grow this account like any fan page and later can use this for research purposes.
Look, if you have person’s account you have to maintain all sorts of information about that person.
And if you have these type of fan page accounts you have to give a lot of time to grow this account and have as many followers as you can so that someone can trust your account.
Choose yourself Which account do you want.
Tips
- Always have a two socks account, so that if one burned you have another.
- Make long terms account. Don’t start researching anyone without making your account enough legit.
- Don’t use real person’s face, because the first things anyone do is to google your photo.
- Try to post daily things creating good b on social media.
