Honeypot Buyer: An Inside Look at the Coordinated Inauthentic Behaviour Economy
Abstract
Most research on coordinated inauthentic behaviour (CIB) studies networks after they have been detected. Less is known about the commercial edge where CIB is sold, one customer at a time, to small businesses. This paper reports a fourteen-day engagement in which the author accepted an unsolicited offer of reviews, likes and follows and played the vendor's buyer under honeypot rules: operator-only contact, no payment, a decoy target the operator controlled, and a stopping rule. The vendor delivered a sample review through a separate persona account, quoted a price curve from USD 3 to USD 0.50 per review, disclosed a reused Bitcoin address and a UK e-money account, stated the account's registered holder in response to a screenshot pretext, and finally asked the buyer to create and hand over a new Facebook page or account. We describe the vendor's tactics, techniques and procedures, mapped to DISARM, analyse the social engineering on both sides through persuasion and negotiation psychology, and release the pretext artifact as an open-source tool. The buyer's seat is a productive collection position, and the case shows the retail CIB economy recruiting its own customers as a source of accounts.
Contents
- 1. Introduction
- 2. Background: CIB as a market, DISARM, social engineering and elicitation
- 3. Method: rules of engagement, capture and enrichment
- 4. The engagement: a fourteen-day timeline, with the conversation re-typeset and redacted
- 5. Vendor TTPs, mapped to the DISARM Red framework
- 6. Social engineering on both sides: the vendor's techniques, the buyer's techniques, honesty in the pretext
- 7. The elicitation artifact
- 8. Indicators: delivery persona, payment, asset demand
- 9. Discussion: the retail edge is reachable; customers as supply; competition harm; detection
- 10. Ethics and limitations
- 11. Conclusion
Tool
The screenshot pretext from section 7, generalised: pretext-form (source and rules of use). It is offline and has no back end.
Related
- The short version: I asked a review seller for 10,000 reviews
- The plain-language public service version, on Trust Report Canada: Someone offered to sell us reviews
- The public record of the vendor account, kept by Trust Report Canada: trustreport.ca/wiki/accounts/review-seller-trc-015
Cite
@techreport{wright2026honeypot,
title = {Honeypot Buyer: An Inside Look at the Coordinated Inauthentic Behaviour Economy},
author = {Mike Wright},
year = {2026},
institution = {mikesploit},
url = {https://mikesploit.com/papers/honeypot-buyer},
doi = {10.5281/zenodo.24120753}
}