Sex Worker Tool Kit

---

Establishing an alias is more than just picking a stage name. Before you sign up for any platform, you should do the following things to protect your real identity and keep your physical location secret:

• Use separate devices: Social media is required for promotion but it will algorithmically out you to people who are physically near you, who have contact info in your phone book or are contacts of your actual friends. If you do not complete this step you have no chance of anonymity and you decrease your chance of safety as well. All steps after this must be completed on your new device.
• Generate your alias:  Go to randomuser.me and click on "New" until you find two identities you would like to use. Save the identity information for future use. We will refer to these identities separately as "Alias info" and "Stage info". Alias refers to the first set of information generated by randomuser.me (name, and info combined). Stage refers to the second set of information generated by randomuser.me; however, the name can be replaced with your chosen stage name. At the end of this step, you should have your real identity, your Alias identity (false name and false info from the first alias), and your Stage identity (stage name and false info from the second alias). 
• Set up your new device: Create a Gmail or iCloud account with your randomuser.me alias info. Follow these directions to secure your device:
  • Android Directions Here
  • iPhone Directions Here
• Create a business email:  You should have a dedicated email address for your business. Make sure you use your Stage Info to create this account. Use a private encrypted service like ProtonMail or Mailfence. They should be more secure because the security efforts at those companies are focused on a limited number of services which an attacker could exploit for access to your communications. They also allow anonymous signup. They're hosted in Europe and comply with GDPR which allows the communication information hosted by their service to be deleted at your request. These particular services do not sell your email information to anyone else for the same privacy reasons.  
• Secure your business email:  Set up your recovery options for both accounts. Use your Alias account to recover your Stage email and use your Stage email to recover your Alias account. All information from both accounts should be fabricated, apart from the real phone number linked to your Alias device. Always enable two-factor authentication for your email account.
• Create A Virtual PO Box Chain:  Use your Stage information and your Alias information to create two virtual PO boxes (you can create as many virtual POs as you'd like, using as many aliases as you'd like, just be sure that the final PO box is linked to your real address). A virtual PO box is a mail service that will receive packages/letters on your behalf, scan each item and then forward it to your account for preview. Create the virtual PO box for the Alias account first and set the forwarding address to your real address. Once the Alias account is created, create the virtual PO box for the Stage identity. Set the forwarding address of the Stage PO box to the Alias PO box. Once the Stage PO box has been created, you can use it to receive packages from your Amazon wish list, or any other service that requires you to receive physical mail. This will prevent you from ever actually having to give out your real address. You can also link the Stage PO box registration info such as email address\phone number to your alias info on a fake LinkedIn account. Since the only way to retrieve the Stage PO box from an Amazon wish list is for someone to pose as a vendor, if anyone views your Alias LinkedIn, you will know that your virtual PO box has been compromised. This will give you some time to shut down the Stage PO box before the attacker is able to reach your Alias PO box, and subsequently, your real address. 
• Create New and Completely Separate Social Media:  To be honest more than half of the security measures on this list would not be necessary if it was not for how social media networks grow. Social media can out if you if:
  • New accounts are not created
  • If you follow your own business account with your personal social media accounts
  • If you allow a single real life friend to follow your business account in solidarity
  • If there is any overlap in your contacts list in your business device and personal device 
  • If similar data like your super clever and unique hashtag is used on more than one account. 
  • If you have the location permissions turned on while near other humans in real life
• Use VPN to hide your real IP Address: Download and install a VPN like ProtonVPN to hide your real IP address. You must do this because there are GeoIP services that will give away your city, state and sometimes street address to attackers. Make sure your VPN is always on for your business device. To test this you can go to google.com and enter a search for "what is my IP" with the VPN off to get your real IP and the VPN on to get your Business IP (aka the fake IP address).
• Set Up a New Payment Platform: You will need to set up a new payment account on your new business device, but be sure to use your Stage info and keep the Stage social network separate from your real social network! Entertainers and fans both like using Venmo and CashApp because though they are not insured by the FDIC, you can get away with not providing any personal information (i.e. you can create an account using your Stage information) and never worry about the service being "hacked" as long as you don't tie it to your real bank account and use their debit card instead. The social network features of these two platforms can work to protect you if used correctly. As an example if you receive payment to your Stage Venmo account, you will want any customer who sends you money in Venmo to be listed as a "Friend or Family" so they cannot "claw back" their payment from you (some scum bags will pay via PayPal so that after you send them the content, they can contest the payment and have their funds returned so they basically got your content for free -- assholes).  One last note: Venmo only allows two accounts to be attached to the same bank account. This means if you share a bank account with a significant other who also uses Venmo or CashApp, you must make sure you set up a separate savings account and use that account info instead of your main shared bank account.) 
• FINALLY you can now setup your OF, JFF or other host platform account! Use your Stage information to set up your account on whichever platform you will be using  (OnlyFans, Patreon, JustForFans, Twitch, etc.). Be sure to review the platform's privacy settings to help you secure your account. For reference:
  • OnlyFans Security Settings
  • JustFor.Fans Privacy Settings
  • Patreon Security Policy
  • Twitch Security Settings

Even if you do not want to be a masked or "anonymous" performer you will still need to protect your privacy. Failing to protect your privacy could result in dangers to your safety. To protect your safety you must:

• Always Remove Metadata: Metadata is geolocation information, IP address information, device information, and other details you don't want an attacker to have. Metadata is attached, by default, to every photo and video you create, so make sure you remove it before storing or sharing the photo or video. Here is an article to help you understand how to view and remove metadata.
• Do not take pictures in the same locations: You might have a favorite spot that you used to take photos or videos for your real life and social media accounts, prior to becoming an entertainer. Those spots are not suitable for promotional social media posts. The only places in your city that can be used without risking exposing your private address, are famous tourist spots. If you insist on taking outdoor photos or videos, you must take photos in multiple tourist spots in multiple cities in your country. If you cannot travel this much, you should fake photos in multiple cities in your country or avoid taking photos and videos outside of your "stage" (the space you use for streams and performances). It may seem extreme but there are many research tools to find your location from purely visual data such as sun location, google maps streetview walkthrough and air flight path data. Removing meta data is not enough. If you need an example walk through here is an article on how the internet is undefeated.
• Never Link your real social media accounts: I provided some information on this in the previous section but I must reiterate this point for emphasis. Linking their personal social media accounts to view or monitor their promotional social media accounts is the single biggest mistake entertainers make.   
• Never Friend or Follow anyone you know in Real Life: Again this is a simple and often care free mistake that threatens an entertainers real life identity and safety. Letting one real life friend in your "stage info" will allow all of their friends, contacts and poorly managed social media choices to affect you. Most people do not know how vulnerable they are on social media. Check out geocreepy.com for yourself or watch this tutorial to see how much data about where you and your friends live and hang out is available on social media. 
• Configure Privacy and Security options in each application:
• Join a forum to keep up with scams that threaten your privacy:

For our purposes, to use counter-intelligence tactics means to purposely put false information into the world to disguise the real you, distract attackers and create honeypot traps to stay at least 2 steps ahead of any stalker.

• Use Disguises to Conceal: A disguise is more than a mask. For a disguise to be effective you have to live it. As an example, a good wig does not look like a wig and it should not be your real hair color, hair length or even hair texture. You can cover your tattoos with full coverage concealer. You should do the same for your birthmarks and identifiable visible features. Consider using eye contacts that contrast with your natural color as well.
• Use Disguises to Misdirect: As an example, changing your eye color with contacts and being consistent in saying you have brown eyes when your eyes are blue in real life will help to conceal your real identity and create plausible deniability if anyone in your real life stumbles across your fan site (oops!). Another favorite is to get fake tattoos and consistently apply them in places where you do not currently have tattoos. For example, you can get a limited edition arm sleeve from a private seller on Etsy, so you can build a relationship with the seller in case you need more tattoos, and you know that no one else will have an identical print. Something like this, but obviously not this. 
• Use Alias info to misdirect: Here's where you really get to fuck with anyone who might be cyberstalking you. Remember the Alias you created with the virtual PO box? Now you get to bring that person to life! You can create as many fake social media accounts as you'd like, but at minimum, you should create a LinkedIn account that has all of your Alias information, and a job title that will make attackers run for the hills (i.e. Cybersecurity Consultant, Law Enforcement Liaison, etc.)  This will act as a honey pot for attackers so that if anyone views these profiles or attempts to exploit the information therein, they will think they found the real you, but will really only be able to exploit false information. This is only catfishing if you attempt to interact with anyone via these accounts; otherwise, it's called a honey pot.
• Catfishing vs. Honeypotting: If you have time and interest, you can use your Alias social media accounts to interact with your attacker in an attempt to gain information so you can turn them in to law enforcement (classic catfishing!). Honeypotting is a little different, in that you will monitor the accounts to see if anyone is following you, because the only reason they would be following you is if the Stage PO box was compromised and revealed your Alias information. If your Alias information is ever discovered, you can burn that identity and create a new one, without needing to invest time to figure out who did it. Allow the company that was compromised to figure it out instead.
• Burn the identity: So what does "burn the identity" mean? It means that you will need to destroy any account that was linked to the Alias identity, obtain a new Alias identity, and create new accounts for the new Alias. 

After all this initial setup work you have to start cyberstalking the real you, the stage you and the alias version of yourself. The good news is you can do this with free tools. The bad news is it is not very easy or automated (YET!) Jaelyn Denise is working :) to see if we can provide this service at an affordable cost. Please follow the project on twitter @ModosiProject. 

You can find additional free (opensource) tools at www.osintframework.com