The accounts we look at are cheap to make. One person with the right tools can run hundreds of them: write the posts, generate the faces, leave the reviews, answer the messages. We’re a small team, so we use the same kind of tools to keep up. AI does the reading and the remembering. People make the calls.
Honeypots
A honeypot is anything we set up to let the other side come to us. Ours come in two kinds.
Accounts that get contacted. Some of the people behind fake accounts and paid reviews go looking for customers. So we let them find us. We run ordinary-looking accounts and inboxes that people like this tend to contact, and we answer when they write. We let them make their pitch, in their own words: what they sell, what it costs, and how they want to be paid. Payment details are often the most useful thing in the whole conversation, because a wallet address or a bank account can tie one account to many others.
Buying the product. When a product shows signs of deceptive marketing or coordinated fake accounts around it, sometimes the best way to test it is to buy it. We pay like any other customer, stay within the seller’s own terms, and check what we get against what was promised.
We never pay for anything that breaks the law or a platform’s rules, like fake reviews or followers. We keep every message and receipt exactly as it arrived.
Investigations
When something looks wrong, we check it against what anyone can see: the profile, the photos, the website, the company records, the review history. We save a copy of everything we look at, stamped with the date and a fingerprint (a hash) that shows it hasn’t been changed since.
Every finding we publish says three things: what was claimed, what we saw, and where we saw it. If we couldn’t verify something, we say so.
Flagging coordinated behaviour
One fake account is a nuisance. A group of them working together is what platforms call coordinated inauthentic behaviour: accounts that act as a team to make something look more popular, trusted or widely liked than it really is.
Our tools watch for the patterns that give a group away: the same words under different names, accounts that always appear together, profiles that share a photo, a website or a payment address. When the pieces line up, we flag it, write down why, and keep watching.
Reporting, built in
Finding something is only useful if it reaches someone who can act. Our tools package what we find into reports, so the evidence arrives in the shape each place asks for: the RCMP and the Canadian Anti-Fraud Centre, the Competition Bureau, the platform that hosts it, and the bank or payment service involved.
A person on our team reads and approves every report before it goes out.
The wiki
The pages on this site link to each other. A company page links to the people who run it. A person’s page links to the accounts and posts tied to them. Every link is backed by a source you can open yourself.
We don’t tell you what to think about it. We show you the trail, and you can walk it yourself.
What we won’t do
- Break into accounts or systems.
- Publish anyone’s private information.
- Name people whose photos or names were used without them, except to say they were used.
- Guess at intent. We describe what we saw, and leave conclusions to the people whose job that is.
Spotted a mistake? See Corrections.