Social News Site OSINT Investigation Tips & Techniques

Reddit is a social news aggregation, web content rating, and discussion website first founded in 2005. Reddit, the 7th most-visited website in the U.S and the 19th-most-visited website in the world, has over 430 million monthly active users.

This article will demonstrate how to conduct OSINT investigations using Reddit.

This is an introduction to OSINT Investigations on Reddit. To view the full webinar, click here. To download the guide, which includes advanced techniques and analysis, click here.

Platform Overview

Subreddits

Subreddits are forums within the Reddit website dedicated to a specific topic. Subreddits allow users to post and comment on a specific interest or topic relevant to the subreddit name. Each subreddit has its own rules, moderators, and voting rules.

Subreddits are contained within URLs following the format, www.reddit.com/r/subredditname, such as https://www.reddit.com/r/worldnews/.

User Accounts

Reddit users have a profile page that captures their username, display name, about section, profile image, banner, posts, comments, karma, and cake day. Reddit users can easily access content either through a web browser or through a mobile app. Unlike many social media sites, Reddit does not restrict users from viewing the activity on the platform without an account, however, only users can post or interact with posts.

Reddit profile pages are contained within URLs following the format https://www.reddit.com/user/username, such as https://www.reddit.com/user/GallowBoob/

Username

Every Reddit account has a unique username that will appear on any posts they make and on their profile page. Reddit is a platform that enables users to remain anonymous and therefore many usernames will have no obvious links to their owners, however, it may be possible to identify personally identifiable information within the username, such as names, locations, or dates of birth. Usernames cannot be changed by Reddit users following account creation.

Display Name

In addition to a username, Reddit users can also choose to display an additional name on their profile, a display name. Display names are not unique and may be shared by reddit users. Unlike usernames, display names can be changed by reddit users. A display name will appear on the user’s profile page but will not appear on posts they make. Display names are more likely than usernames to provide clues to a reddit user's real identity, such as their real name.

About Section

A Reddit user’s profile may contain a small section of text that contains their biography. The About Section is blank by default but can be populated by users who wish to share information.

Profile Image/ Avatar

A profile image or avatar is present for each Reddit user. Many avatars are those automatically generated by the platform but many are those designed by the user.

Banner

Like many other social media platforms, Reddit enables users to add an additional image as a banner. The banner space is blank unless the user decides to upload one.

Karma

Karma is often referred to by users as “fake internet points”. When a user posts a topic or a comment on a topic, other users can upvote or downvote their submission, increasing or decreasing their post karma respectively. Karma scores are cumulative, so the Karma score on a user's profile page is the total Karma from all comments and posts. Some Subreddits weed out spam and troll posts by setting a minimum Karma score to post.

Cake Day

A Cake Day is the yearly anniversary of when a Reddit user created their account. A small cake icon appears next to any posts or comments made by a user on their Cake Day.

Trophy Case

Reddit users accumulate trophies by using their accounts, which are displayed on the user profile’s Trophy case. 

Moderators

Each subreddit has its own moderators, who are Reddit users assigned to monitor posts and comments within the subreddit, ensuring that they follow the established rules. Moderating is time-consuming so any subreddit that a Reddit user moderates is likely to suggest a strong interest in the subreddits topic.

Posts/ Threads

Posts, also known as Threads, are individual topics of discussion within a subreddit. Each post has its own URL. The originator of a post is commonly referred to as the ‘original poster’ or the ‘OP’. Posts may be text, images, or videos, depending upon the subreddit the post is made within. The posts of a specific Reddit user can be viewed by navigating to their profile page using the URL https://www.reddit.com/user/username/posts/.

Comments

Comments are the responses made by Reddit users within a Post/ Thread. Comments can be made by any Reddit user, including the OP and can include text or links to another website or image. Comments can be made to the main post or in reply to another comment, with replies cascading beneath the main comment. The comments of a specific Reddit user can be viewed by navigating to their profile page using the URL https://www.reddit.com/user/username/comments/.  

Flair

Flairs are subreddit-created pieces of information that can be set by users on specific subreddits to appear to the right of their username when they post or comment. Flairs can contain favorite character names, location names, or other affiliations that a Reddit user has and wishes to display.

Locating Content

Platform Field Search URLs

When searching within the Reddit platform itself, investigators can utilize the built in search bar and URL manipulation.

Search for posts within subreddits: https://www.reddit.com/search/?q=subreddit%3Akeyword

Investigators can search for subreddits by keyword by replacing ‘keyword’ with the relevant topic in the above URL, such as https://www.reddit.com/search/?q=subreddit%3Aosint.

Search posts by keyword in title: https://www.reddit.com/search/?q=title%3Akeyword

Investigators can search for posts containing topic keywords by replacing ‘keyword’ with the relevant topic in the above URL, such as https://www.reddit.com/search/?q=title%3Aosint.  

Search posts by contained URLs: https://www.reddit.com/search?q=url:keyword

Investigators can search for posts containing a URL or a keyword within a URL by replacing ‘keyword’ with the relevant URL or keyword in the above URL, such as https://www.reddit.com/search?q=url:osint.   

Search posts by author’s username: https://www.reddit.com/search/?q=author%3username 

Investigators can search for posts made by a specific Reddit user by replacing ‘username’ with the author's username in the above URL, such as https://www.reddit.com/search/?q=author%3Agallowboob.  

Search posts by topic flair: https://www.reddit.com/search?q=flair:keyword 

Investigators can search for posts with a topic flair that contains a specific word by replacing ‘keyword’ with the relevant topic in the above URL, such as https://www.reddit.com/search?q=flair:osint.

Search comments by keyword: https://www.reddit.com/search/?q=keyword&type=comment 

Investigators can search for comments made containing a specific keyword or phrase by replacing ‘keyword’ with the relevant word in the above URL, such as https://www.reddit.com/search/?q=skopenow&type=comment.   

3rd Party Applications

Pushshift Reddit Search - https://redditsearch.io/

Pushshift Reddit Search is a search engine and real-time analytics tracker for Reddit. To use Pushshift Reddit Search, enter a keyword into the Search Term field and hit the Search button. Filters can be used to select if you want to search for posts, comments, or statistics.

Results will populate below the search button.

Pushshift API Post Search - https://api.pushshift.io/reddit/search/comment/?author=username&sort=asc&size=100

Pushshift API Post Search provides up to 100 posts made by Reddit users in JavaScript format. To retrieve posts made by a specific user, edit the username in the above URL, such as https://api.pushshift.io/reddit/search/comment/?author=gallowboob&sort=asc&size=100. 

Pushshift API Comment Search - https://api.pushshift.io/reddit/search/comment/?q=keyword 

Pushshift API Comment Search provides up to 100 comments containing specific keywords in JavaScript format. To retrieve comments containing a keyword, edit the keyword in the above URL, such as https://api.pushshift.io/reddit/search/comment/?q=osint.

This is an introduction to OSINT Investigations on Reddit. To view the full webinar, click here. To download the guide, which includes advanced techniques and analysis, click here.

Automating your Investigations on Reddit

Using a tool like Skopenow, you can automate the processes outlined in this article to extract and analyze content from Reddit. Skopenow instantly and anonymously locates and archives social media accounts and posts, plots location history, flags actionable behaviors, and reveals hidden connections between individuals. Skopenow’s automatic report builder will save you time organizing the analyzed intelligence into a court-ready report. Please reach out to sales@skopenow.com or visit www.skopenow.com/demo to schedule a demo and activate a 7-day free trial for qualified businesses.