Engineered relationships are an established route into company secrets.
Security agencies in several countries have warned that intelligence services and organised groups build relationships under false pretences to reach people with access to technology, code and plans. The approach can come as a new partner, a friend, a recruiter, an investor or a contact met at a conference. It is built to feel like luck, and it targets what you can reach at work.
Based in Singapore. Many of the honeypot campaigns aimed at people in tech are run out of Asia, so we work close to where they start.
Counterlure keeps a confidential register of reports from people in tech and looks for the same face appearing under different names. Submitting a report is free and anonymous. It does not return a result: we notify only private inbox members, and only after a person has reviewed the pattern.
- No account to submit
- Photos never shown to other users
- The person is never contacted
- Every pattern reviewed by a person
Report received
This is your private receipt. It's the only link between you and this report. We can't show it to you again.
Want to be notified if a pattern is found?
We never show results on screen. Notifications go only to private inbox members, after a person has reviewed the pattern.
- They studied your profile before you saw theirs.Approaches are researched and rehearsed.
- Trust is the attack surface.Verify people the way you would verify code.
- Your access is the asset.Your repo, your roadmap, your badge, your laptop on their Wi-Fi.
- We don't warn the world.We notify members privately, and no one else.
Signs worth a second look
- Intense attention or flattery, very early
- Unusual curiosity about your work, team or access
- Always a reason not to video call
- Details of their story keep shifting
- Pushes to move the conversation to a private channel quickly
- Asks you to install something, or to join your network
Any one of these can be innocent. Several together are a pattern.
A pattern no single person can see
The same face appearing in the lives of several people in tech, often with a different name each time, is invisible to each of them alone. A shared, confidential register makes it visible.
You submit
A photo and the name they gave you. Free, with no sign-up. We strip all metadata (location, device) from the photo. Nothing is shown back to you.
We compare
The face is turned into a mathematical fingerprint and compared with other reports. Names are compared too, and differences are flagged.
A person reviews
When a pattern meets our threshold, it goes to a human reviewer. Nothing is ever sent automatically.
Members are notified
If you have a private inbox and reported that person, you get a message there. Nobody else learns anything.
When does a pattern count?
independent reports of the same face, including at least one from an inbox member
independent reports of the same face from anyone
Repeated reports from the same source count once. A match is a reason to be careful, not proof of anything, and it is reviewed by hand before anyone is told.
What security agencies say
Counterlure is independent and not affiliated with any government. These public resources describe the threat in the agencies' own words.
- UK Government: Think Before You LinkA campaign and app to help people spot fake online profiles used by foreign intelligence services and other malicious actors.
- FBI and NCSC: The Nevernight ConnectionA short film, based on a real case, about a fake online profile used to recruit someone with access.
- US NCSC: awareness materialsVideos and guides on social media deception, elicitation and human targeting.
Built on the assumption that anyone could be wrong
Including you. So no one's details are ever shared with anyone else.
What we keep
- The photo you upload, encrypted, visible only to the reviewer, deleted after 180 days or when a case is closed.
- A face fingerprint (numbers, not an image) used for matching.
- The name you were given and where you met.
- A one-way scrambled code derived from your network address, so one person can't report the same face five times. It can't be turned back into your IP address.
What we never do
- Ask for your name, email or phone number.
- Show anyone else's report, photo or name to you, or yours to them.
- Contact, warn or expose the person who was reported.
- Tell you how many people reported, or who.
- Give organizations that contact us any reporter's identity, photo or report.
- Use trackers, ads or analytics. No cookies unless you log in to an inbox.
- Send anything automatically. A person reviews every pattern.
The only way we can notify you
Submitting is free, but we never collect contact details and never show results on screen. If a reviewed pattern involves someone you reported, a private inbox you log into is the only way we can tell you. Inbox members' reports also carry more weight, because they're expensive to fake.
- Log in with a username and a code from Google Authenticator (or any authenticator app). No email, no password.
- Link any report you've made using its receipt.
- Lifetime access. Paid in crypto, so no card or bank details.
- We cannot recover a lost account. You get recovery codes at setup, so keep them safe.
Launch offer, until 30 November.
Bitcoin, Ether or USDT (Ethereum or Tron). Choose a username and set up an authenticator app, then pay to an address we show you and paste the transaction ID. Your inbox opens as soon as the payment confirms.
Open a private inboxAlready a member? Log in
Concerned your staff are being targeted?
Security, legal and leadership teams can contact us to discuss whether we are seeing a coordinated approach against their organization or sector.
- We share reviewed findings only. We never disclose reporters' identities, photos or the names they were given.
- We never contact or expose the people who are reported.
- Reports don't record where the reporter works, so what we can tell you depends on what we have seen. We'll be clear about the limits.
Contact our team
Write from your work address and tell us your organization and role. Please don't send photos or names of individuals by email.
Email [email protected]Based in Singapore. We reply to verified organizations.
Questions
Does submitting a report tell me anything?
No. Submitting is free and adds your report to the confidential register, but nothing is shown on screen. If a reviewed pattern involves someone you reported, we can only notify you through a private inbox. You keep a receipt, so you can link the report to an inbox later.
Will the person find out I reported them?
No. We never contact the reported person, and nothing about your report is ever shown to anyone except the reviewer.
Does a match mean the person is a spy?
No. It means several people in tech independently reported the same face, often under different names. That's worth knowing, but it isn't proof. People use nicknames, change names, and some people simply meet a lot of others. Treat a message from us as a reason to be careful, not a verdict.
What should I do if I'm worried right now?
Don't share work details, credentials, devices or travel plans. Don't connect their devices to your networks. If you hold sensitive information, talk to your company's security team. If you think a crime is involved, contact the authorities.
Can my organization find out if its staff are being targeted?
Contact us at [email protected]. We can discuss what we're seeing against an organization or sector, but we never disclose who reported, their photos or the names they were given.
Can someone abuse this to track a person?
We designed against it. Results are never shown on screen, counts are never revealed, every case is reviewed by a person, and reports from one source are counted once. Using Counterlure to monitor an ex-partner or anyone else is prohibited.
Can I delete a report?
Yes, if it's linked to your inbox. Withdrawing a report deletes the photo and the face fingerprint. Unlinked anonymous reports expire with our 180-day photo retention.
Who runs Counterlure?
An independent team based in Singapore. We are not affiliated with any government or intelligence agency.
How do I contact you?
Email [email protected]. Please don't send photos or names by email. For updates, follow @honeypotbuster on X.