OPS · 002 / OF 008 |
OPSEC |
A sock puppet is a fictitious online identity built to access platform-gated content and observe communities without revealing the investigator's true affiliation. Its investigative value lies in separation: a well-maintained research persona gives access to private groups, closed communities and blocked accounts while insulating the investigator's primary identity from counter-surveillance. That value depends on the persona having age, activity history and internal consistency.
The method applies when accessing content visible only to logged-in users on a platform where the investigator is blocked, observing closed or private groups without alerting the target community, conducting passive monitoring of extremist or influence networks, verifying that a target account can see specific content before approaching openly, or separating investigative research from a journalist's professional account history. Deployed too early or without separation, a persona becomes a liability. Built on consistent infrastructure, a warming history and single-objective discipline, it becomes a dependable research asset.
OPS-002 sets out the methodology for creating, operating and retiring sock puppet accounts to evidentiary standard.
Forensic count Eight workflow steps, eight tools, six false-positive checks, six chain-of-custody requirements. |
01 Required Tools Eight tools, including VirtualBox, MySudo, Proton Mail, KeePassXC and Hunchly. | 02 OPSEC Legal sign-off, one VM per persona, matched time zone, no false SIMs. |
03 Workflow Eight steps from requirement definition through build, warming, observation and clean retirement. | 04 False Positives Verification prompts, VPN-triggered checks, friend suggestions, warming content, stale group posts. |
05 Chain of Custody UTC session log, SHA-256 per capture, hashed VM snapshot, encrypted credentials. | 06 Key Queries Six queries across Sherlock, Google, IPinfo, VBoxManage, sha256sum and Wayback Machine. |
Download the card.
A PDF version of OPS-002 is available below for Signal subscribers.
The rest of this card is for Signal subscribers.
What remains: the step sequence, the tool list, the false-positive checks and the chain-of-custody note. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalSignal includes:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
- OSINT Hub community access