Guide: Using Reddit in OSINT

An in-depth guide for OSINT researchers on gathering open-source information on the popular forum social network, Reddit.

Social media intelligence (SOCMINT) is a subcategory of open source intelligence (OSINT) concerned with using data from social media platforms. These platforms' vast user base and the type and breadth of information users post make them a goldmine for publicly available information (PAI).

The number of social media platform users is increasing at a rapid pace. According to Datareportal, 62.3% of the world population uses social media, equal to 5.07 billion people. Users are utilizing social media to socialize, check products and services, and communicate with their peers, government organizations and commercial companies. Social media users post all types of content to these platforms. This includes text posts, images, videos, live broadcasts, audio, geographical locations (via check-ins), voice and other types of files (e.g., MS Office and PDF documents). This makes social media platforms rich sources of information that can be harnessed for free in various OSINT investigations.

The vast amount of user-generated content on social media provides valuable insights into public opinion, trends and behaviors. SOCMINT techniques can be applied to gather intelligence for various purposes, including market research, competitor analysis, brand reputation monitoring, cyber threat detection, law enforcement investigations and inspecting public opinions about political, environmental and economic policies.

We have already covered how to perform OSINT on Mastodon, Discord and X (Twitter). This guide will explore how to leverage OSINT to gather intelligence from Reddit. Reddit, known as "the front page of the internet," offers a unique ecosystem of communities (subreddits) that can provide targeted information on specific topics, making it a valuable resource for SOCMINT practitioners.

Explore more posts on social media intelligence >

However, before discussing techniques for collecting information about Reddit users and communities, I will begin defining its architecture, exploring its interface and learning how to navigate it.

Reddit architecture

Founded in 2005, Reddit is a U.S. social media platform that resembles traditional discussion forums, which were popular in the early days of Web 2. Reddit is composed of many communities (also known as subreddits), and each subreddit specializes in talking about a specific topic or area of interest. For example, there are subreddits for science, environment, marketing, freelancing, agriculture, cybersecurity, gaming, sport, fashion and even OSINT. Users interact with each other within these communities and post content for other users.

According to Reddit's official statistics, there are over 73 million daily unique active users, over 100,000 subreddits and over 1 billion cumulative posts. This makes Reddit an excellent source for OSINT researchers.

Reddit communities can be grouped into four groups:

1. Public: Anyone can post, view or comment
2. Restricted: Users can view and comment but need permission to post content. This permission is granted by the community moderators, who can also remove approved members from their communities.
3. Private: Users must be approved before viewing or posting content. Moderators can remove approved users.
4. Premium-only: These communities are directed only to Reddit premium members. However, a non-premium Reddit user can moderate such communities.

Users can join any number of communities; however, their Reddit feed will only display content from 250 subreddits. To see the list of subreddits you have already subscribed to, you can go to this link.

Reddit does not require its users to reveal their true identity. For instance, a user can register for a new Reddit account using any of the following methods:

1. Phone number – in eligible regions
2. Google or Apple account
3. Email address

Signing up using an email address is the perfect choice for keeping your identity anonymous. Users can create multiple Reddit accounts using the same email address. However, this option is unavailable for users signing in using their Google/Apple account.

Reddit is a community-focused platform where user votes determine the visibility of posts and discussions. Next to each post and comment, arrow icons (see Figure 1) allow you to "upvote" or "downvote" content. Upvotes indicate that users believe the content positively contributes to the community or the platform. Downvotes usually mean users think the content is unworthy of visibility.

Figure 1 - Reddit allows its users to upvote or downvote posts or comments to determine their visibility level Now that we understand the main concept of Reddit let's begin discussing techniques for gathering intelligence from the platform.

Inspecting Reddit communities (subreddits)

Reddit is composed of many communities centralized around a specific topic or subject. To find communities that discuss a particular topic or interest, you can use the Reddit search functionality at the top of the Reddit page (I’m using the Reddit web interface) (see Figure 2).

Figure 2 - Use the Reddit search feature to locate communities of interests

There are external services listing subreddits according to different criteria.

• Statista: Most popular communities on Reddit worldwide as of February 2024, by number of subscribers
• Gummysearch: List top Reddit communities according to different criteria, such as monthly growth and engagement
• Reddit List: View a large number of subreddits grouped according to the number of subscribers, recent activities and growth (24 hrs)
• We can also leverage the Google search engine to find subreddits. Although this technique will not fetch all subreddits, it reveals many. Use the following Google search operator: site:reddit.com/r/ 

Learn more about advanced search techniques and Google dorking >

Figure 3 - Use the Google search engine to find subreddits

It is important to note that Reddit allows the posting of adult content. Check out this guide to adjust your Reddit account preferences to view NSFW communities. When accessing such content on specific subreddits, Reddit labels it with a "Not Safe For Work" (NSFW) warning that users must click to view. According to a Reddit post, adult content makes up about 25% of the platform's total content, making Reddit one of the most prominent places on the surface web for this type of material.

To search for NSFW subreddits, you can use these services:
Social Rise: Browse thousands of NSFW subreddits with easy search and filters
r/ListOfSubreddits: A subreddit containing links to scores of subreddits grouped by category, including a link to NSFW subreddits

Now, after knowing how to search and find subreddits, let us pick one and investigate it:

I selected the subreddit named r/Earth. All subreddits begin with the r/ followed by the subreddit name. Please note that there is no space in the subreddit name. For example:

r/earth

/technology

r/databreach

When examining a subreddit page, the OSINT gatherer should analyze the following information:

• Subreddit description: This information is on the right side of the subreddit page. It includes a “brief description” of the subreddit and “Rules” that set the terms for users when posting or commenting on the subreddit (see Figure 4).
• Subreddit metrics: This includes the following information (number of subscribers, number of users online and the subreddit rank).
• Search bar: The search bar is at the top of the subreddit page. The subreddit's name appears within it, which means we can search specifically within this subreddit.
• Content overview: These appear in the middle of the page. After performing a search, Reddit provides several sorting options that can help OSINT researchers refine their results:
  • Hot: Shows popular posts that are currently trending in the subreddit
  • Top: Displays posts with the highest number of upvotes, which can be further filtered by time (e.g., today, this week, this month, this year or all time)
  • Rising: Highlight posts quickly gaining popularity but have not yet reached "Hot" status
  • New: Lists the most recent posts, regardless of their popularity
• Subreddit header image: Located on the top page section of the subreddit
• Subreddit profile image: This could be an icon or image

Figure 4 - A typical subreddit page

• Moderators: A list of moderators responsible for moderating the subreddit (see Figure 5)

Figure 5 - For each subreddit, there is at least one or more moderators

These were the most prominent sections on the subreddit page. We should note that some subreddits may contain additional information that can typically be found on the right pane of the subreddit page, such as:

Related subreddits: Links to other communities with similar topics or interests

Flairs: Tags used to categorize posts within the subreddit
Custom widgets: Some subreddits have unique features like calendars, leaderboards or custom links

Wiki: Many subreddits maintain a wiki with in-depth information about their topic

Inspecting subreddits images

The subreddit header image and profile image or icon should be inspected thoroughly using reverse image search and for metadata (which is hidden data within images or videos). The same thing applies to any image, video or animated GIF that we may find suspicious and need to be investigated in the subreddit feed.

This systematic approach to visual content analysis of the Reddit media files is crucial for OSINT researchers:

Reverse image search

The subreddit header image and profile image or icon should be inspected thoroughly using reverse image search and for metadata (hidden data within images or videos). The same applies to any suspicious image, video or animated GIF in the subreddit feed.

Reverse image search can help find other occurrences of the image across the web. This helps OSINT researchers discover potential connections to other platforms or individuals. The following tools can be used:

• TinEye reverse image search
• Yandex images
• Google reverse image search
• Bing image search

If the image contains humans, dedicated face search engines powered by artificial intelligence can be used. Here are some tools:

• Pimeyes: Face search engine
• Facecheck ID: Find people online by photo

Metadata analysis

Hidden data within digital files can provide valuable information, such as:

For images:
EXIF data might include creation date/time, device used and sometimes GPS coordinates. Here are some tools to inspect EXIF:

• ExifTool by Phil Harvey
• Exif Pilot
• Azure AI Vision Image Analysis service

For Videos:
The metadata of video files provides information beyond the visual content itself, such as the creation and modification date, video and audio codecs, frame rate, resolution, embedded subtitles, camera technical information and sometimes location data.

Here are some tools to inspect video file metadata:

• MediaInfo
• VLC Media Player
• MP3TAG
• Metadata2go (Online viewer)

For GIFs:
GIFs typically contain much less metadata than image formats like JPEG or PNG. However, it is still worth trying to extract the available information. Here are some tools:

• Ezgif
• Exifmeta

Content analysis

The visual content of images and videos itself might provide clues about locations, events or people relevant to the investigation.

Recurring themes

If the same images are used on different subreddits, this could indicate connections between communities. Special care should be taken to custom-made logos or banners as this can point to relationships with other groups or individuals.

Reddit search

The Reddit built-in search function allows users to find specific content across the platform. The search bar is at the top of the Reddit homepage and will appear on all pages across the platform when using the web interface (see Figure 6).

Figure 6 - Reddit's basic search feature

To search for a particular keyword, type it in the search bar. For example: “OSINT resources." Reddit provides five content filters to sort search results:

1. Posts: This is the most comprehensive search filter. It returns posts containing text, images and videos. The results can be refined into Relevance, Hot, Top, New and Comment Count. They can also be sorted according to their post time: All time, Past year, Past month, Past week, Today, and Past hour. There is also a Safe Search filter that can be turned on or off.  
2. Communities (subreddits): Search for communities or subreddits relevant to the keyword.
3. Comments: Search within comments relevant to the keyword.
4. Media: Return media-only content (images, videos, GIFs).
5. People: Use this filter to find a specific Redditor. It is not available if you are searching within a community.

In Figure 7, you will find screen images of all Reddit search filters.

Figure 7 - Reddit basic search available filters

Exact phrase search

If you want to search for an exact phrase, enclose your search keywords with quotes.

For example: “OSINT resources”

This will return posts containing the exact phrase “OSINT resources”

Search by author or writer

To search for Reddit posts written by a specific user, use the “author” filter operator.

For example: author:Darknessgate

This search query will return all posts written by Reddit user “darknessgate”

Title-Only Search

Use the “title” filter operator to search for a specific keyword only in the titles of the posts.

For example: title: OSINT resources

This search query will find all Reddit posts whose title contains the keyword “OSINT resources”

In the previous example, we can also use another filter operator (minus sign (-) to exclude terms).

For example: title:OSINT -resources

Search within post content

Use the selftext operator to search for keywords within the post content.

For example: selftext:OSINT book

This search query will find posts containing the search query “OSINT book” within posts contents.

Find content delivered by a specific domain name

To find all Reddit posts containing links to a specific domain name, use the "site:" search operator.

For example: site:authentic8.com

This search query will find all posts containing links to the authentic8.com website (See Figure 8).

Figure 8 - The Reddit "site:" search operator finds all Reddit posts containing a link to a specific website

We should note that the Reddit “site” search operator differs from Google's "site:" operator. In Reddit's search, "site:" looks for posts containing links to the specified domain, not posts from that domain itself.

We can combine the Reddit “site:” operator with other search features to narrow returned results.
site:authentic8.com subreddit:OSINT

This search query would find posts containing links to authentic8.com, specifically in the OSINT subreddit.
site:authentic8.com author:darknessgate

This search query would find posts by a specific user (darknessgate) that link to authentic8.com.

To find a complete list of all Reddit-supported search functions, visit the following Reddit Help search page.

Use third-party search tools
If the Reddit basic search feature is not handy, you can use third-party search tools to facilitate finding information on the Reddit platform. Here are some online services:

• Redditsearchtool
• Reddit Comment Search
• Better Reddit Search

Inspecting Reddit user profiles

After inspecting subreddits and learning how to use the Reddit basic search feature, let's analyze Reddit user profiles. Here are the main elements of a Reddit user profile page (see Figure 9).

Figure 9 - A general view of the Reddit user profile

Username analysis

First, execute a reverse username search. Reddit usernames begin with u/ followed by the username. The username is a unique identifier assigned to your account when you create it. It appears in all places when a user writes a post or sends a comment. The username also appears in the Reddit URL, such as https://www.reddit.com/user/Authentic8. Many social media users use the same username across different social media platforms. This helps OSINT gatherers reveal all social media accounts with the same username. Here are some tools for reverse username search:

• Instant Username Search
• Socialcatfish
• Usersearch

Search for usernames in breached data repositories

Data breach websites collect information exposed in security breaches, including emails, usernames, passwords and other identifiers. Searching these repositories using a Reddit username can uncover other accounts linked to that user. Here are links to some data breach search engines:

• Have I Been Pwned
• Pastes.io

Display name

Many Reddit users use the same username as their display name. However, this is not a rule. If we encounter a Reddit profile that uses a Display name that is different from its username, then we can execute a search for that Display name to see where it appears.

"Authentic8" inurl:forum OR "Authentic8" inurl:community | This search query searches for pages containing "Authentic8" within a forum or community URLs.

"Authentic8" site:socialmedia OR "Authentic8" site:blog | This search query searches for pages containing "Authentic8" on social media or blog platforms.

Profile and banner images

Like subreddits, a user profile may contain a header banner and a profile image or icon. Perform a reverse image search on both images and check their metadata for useful information.

To view a Reddit user profile image in full size, right-click over the image and select “Open in new tab.”

Cake day

This is the date when the Reddit profile was created.

Post and comment karma

Reddit uses "karma" to reflect a user's contribution quality and popularity. It is divided into two types:

Post Karma: Accumulated from upvotes (positive) and downvotes (negative) on user posts.

Comment Karma: Similar to post karma, but based on upvotes and downvotes on user comments.
High karma could indicate that a user always provides valuable content or insights. This helps OSINT researchers identify top influencers in specific Reddit communities. However, karma can also be a useful indicator for identifying potential disinformation campaigns. The following describes this in some detail:

Legitimacy indicator: High karma gives a user's posts credibility, making their content more likely to be trusted and shared by other Reddit users and even by the Reddit algorithm.

Rapid Karma accumulation: Reddit accounts that gain a large number of karma very quickly might be part of organized efforts to build credibility to launch disinformation campaigns.

Karma vs. Account age ratio: A high karma-to-account age ratio may indicate these points were acquired using bots or other fake techniques.

Content vs. Karma discrepancy: Accounts with high karma numbers but low-quality content could suggest vote manipulation.

For OSINT researchers investigating disinformation across the Reddit platform, they should note the following:

• Track karma growth patterns of a Reddit user over time
• Analyze the types of content generating the most karma
• Look for similar Reddit accounts with high-karma posting similar content
• Investigate sudden changes in posting habits or content focus

Brief description

This is a short bio about the user. This could be anything and may contain custom URLs to other linked websites and accounts on social media platforms belonging to that user, as well as information about a user's profession, location or interests.

Links

If the user bio does not contain links, a dedicated widget might contain links to other social media accounts operated by the user. In Figure 9, the Reddit user “Authentic8” has posted links to its social media accounts on LinkedIn, Twitter, YouTube and Instagram.

Other communities moderated by that user

If that user moderates other subreddits, we might find this information under a widget named “Moderator Of These Communities.” This widget displays links to other subreddits moderated by that user.

Trophy case

Trophies showcase a user's contributions, longevity and participation in the Reddit community. These Trophies are visual representations of a user's accomplishments on Reddit. For example, in Figure 9, the Reddit user “Authentic8” has three trophies:

• Verified Email: They have their email account verified
• Eight-Year Club: This means the user has been a registered member of Reddit for eight years
• Gilding III Reddit per annum: "gilding" points to the act of giving gold awards to other users' content. While the word “Gilding III” refers to the level. For this user, this suggests that the user has given a significant number of gold awards to other users.

Find deleted content on Reddit

A user may delete their posts or comments on Reddit. Some services can help you find deleted Reddit content. Here are the most prominent ones:

• Reveddit: Find deleted posts and comments for both users and subreddits (see Figure 10)
• Resavr:  Retrieve deleted Reddit comments
• Wayback Machine: This service has an archive for the entire web, including Reddit.

Figure 10 - Reveddit allows viewing deleted Reddit posts and comments for both user profiles and subreddits

Reddit users profile third-party analysis tools

Some third-party tools analyze Reddit user profiles and extract a large amount of information, displaying it in graphical representations. Here are the most prominent Reddit user profile analyzers:

• Redditmetis: Provides a comprehensive analysis report that includes activity patterns, comment statistics, submission statistics and corpus statistics. These statistics allow OSINT gatherers to understand different information related to a target Reddit account, such as preferred times for posting (this can identify a Reddit user's work and sleep patterns) (see Figure 11).
• Redective: Another free online service for analyzing Reddit users' profiles

Figure 11 - Redditmetis analysis of a Reddit user profile

In this guide, OSINT gatherers have a comprehensive practical manual on the various techniques for leveraging Reddit as an OSINT resource. We have thoroughly covered how to use Reddit's built-in search feature to find and locate information across this platform. Many third-party tools were provided to enhance data collection and analysis, in addition to numerous tips on how OSINT researchers work when inspecting the Reddit platform.