For more detailed information on setting up corporate honeypots, check out this article. The second option is a little easier, since you won't necessarily have to create an identity around it, but that also limits its effectiveness in certain scenarios.Ĭorporate honeypots are the easiest of the bunch, as they can be as simple as a fake LinkedIn profile with a corporate email address that silently forwards all requests to the security team (easy to set up if you work for the organization's security team), though they can also be set up as fully formed sock puppets, depending on the needs of the organization. Also, if at any point someone figures out that this person isn't real, you'll have to start completely over. The first option is significantly more difficult, as you'll need an identity to support the fake persona - other social media accounts (with a fairly extensive history), other online accounts, information to support this identity. Either you're creating a fake identity - someone who appears to be a real person, but doesn't actually exist, like 'Norm Smith' - or an avatar of a person based around an idea - such as a Twitter persona like They're not pretending to be a complete representation of a person, just someone who likes Christmas a lot and can authentically participate in discussions. There are two tracks to follow when creating a fake person. Additionally, impersonating a real person can often violate laws in the USA and other countries (particularly if that person is law enforcement or military). Usually, creating a fake person will violate the terms of service for most social media platforms, so if your goal is anything other than academic research purposes, it's probably worth re-thinking.

Honeypots are commonly created by corporations to lure cybercriminals and filter BEC attempts directly to the security team.

Nation state actors, or researchers seeking access to cybercriminals' dark web forums, often use active engagement to solicit sensitive information or build connections.

Passive recon sock puppets are often used by researchers or private investigators to avoid their target to knowing who is looking at their social media accounts. They can either be used for passive recon, active engagement, or honeypots. A sock puppet is a fake account which can be used to hide the true identity of the owner for operational security reasons (used by both attackers and security researchers).

Download sockpuppet for free