Tag: OSINT

Sockpuppet account creation, just like OSINT, is always changing. This page will be updated regularly. Please join the newsletter to be notified of updates.

The Cyber Mentor and Security Blue Team currently both use this guide in their training, and I’m also published in 2600 Hacker Quarterly (Autumn 2016).

What are sockpuppet accounts?

Sockpuppet accounts are anonymous or pseudonymous accounts used for various projects.

• In the news lately for political discord
• OSINT investigations
• HUMINT investigations
• Social engineering
• And more!

Are sockpuppet accounts ethical?

This is up to you. Honestly. But this is my blog so here’s my thoughts on it:

Sockpuppets, an an OSINT/HUMINT capacity, have generally been used in two ways:

1. Passive reconnaissance. (Generally OSINT)
2. Infiltration of groups. (Generally HUMINT)

I have absolutely no ethical qualms with using sockpuppet accounts for passive recon.

With HUMINT, infiltrating target groups is a common necessity. In this case, you often have to pretend to be someone you’re not.

For example, an investigator hired to collect data on a pedophilic ring on the dark web will have to create a persona and convince them they are one of them to get into the group.

I generally don’t do this sort of work. I would only feel comfortable if I had law enforcement backing me in this because it could turn dangerous or illegal, and they’ll help me with making sure I’m not breaking any laws or getting into any trouble they can’t get me out of.

I also need to point out in the USA, it’s illegal to impersonate a government employee, especially law enforcement and military.

It’s also generally not cool to impersonate a real person. Keep your sockpuppets made-up.

Anonymous Sockpuppet Account Setup Process

This is my process for setting up an anonymous sockpuppet account.

1. Come up with a persona for the sockpuppet account.
2. Use Fake Name Generator to create a person whom you feel fits your sockpuppet persona.
3. Use This Person Does Not Exist to generate an image. Make sure you inspect the image closely and get one that doesn’t have any obvious flaws, as they often do. It is worth picking up some Photoshop, GIMP, Affinity Photo or Designer, or other basic image manipulation skills to fix them and change the background of the image.
   • July 2020 Update: Social media sites have wised up to this and it doesn’t always work. I have found that “photoshopping” a pair of sunglasses on the face and changing the background seems to work for now.
   • November 2025 Update: There are so much better people generator AIs now. You can probably use any of them.
4. Get a burner phone, completely wiped and fresh. Can be any brand that will accept a Mint Mobile SIM card.
5. Get a burner credit card from Privacy.com to use on Amazon and possibly the Mint Mobile setup. They might need it to set up the account.
6. Set up a burner Amazon account. We’re only going to use it once.
7. Buy a Mint Mobile SIM card. You can find them in various places online and in stores near you, but you can get one of them for $45 on Amazon (aff). They also give you 1-week free trial with something like 100 text messages, which we’re going to use. This gives you two cards for two sockpuppet accounts for only $5.
   • November 2025 Update: They don’t offer the $5 cards anymore. The link above still works as for the best price I could find.
8. I like to use Amazon to have the card sent to an Amazon pickup box, which can be anonymous.
9. Get a VPN that you can set to the physical area in which you want your sockpuppet to “exist.”
10. Set up the Mint Mobile trial account somewhere away from your home; as far as you’re willing to go.
11. Use this Mint Mobile trial phone number to set up all of the websites you need.
12. I recommend at least set up a Google account and Protonmail account. Both will come in handy at different times.
13. Once you’ve set up all the accounts with your trial Mint SIM, set up 2FA on all of the accounts.
14. After setting up 2FA on all of the accounts, change the phone number to one you have more permanent access to, such as MySudo or Google Voice.
15. Make sure everything works!
16. Destroy the SIM card.
17. Wipe the phone.

Notes:

A lot of these websites are blocking MySudo, Google Voice, and other VoIP numbers. That’s why we go through the Mint phone number first.

They should be less stringent using Mint.

People tell me this process still works so if you want to thank me you can buy some music at this link: https://megabyteghost.bandcamp.com