Sneaky, sneaky, sneaky reddit

VisualA said:

I was botting reddit last night, going over my code and using playwright to identify links (I'll spare you the boring details).

I use dolphin anty, python and a rotating mobile proxy called iproxy. So far it has been a great setup. So long as I don't do anything stupid, I am 100% undetectable (at least so far). But last night I noticed something rather clever. When you set up a reddit account, they ask for an email. Now, this is nothing new, and emails are by no means difficult to create. Reddit will accept pretty much any email address you give them. However, they do not immediately ask you to verify it. And this is where the sneakiness comes in.

After logging in two or three times, browsing, leaving comments, upvoting, etc... reddit hits you with a popup in the upper right hand corner under notifications. It is small, but easy enough to see if you are a human. The popup just says "Please verify your email" and has two buttons (update email) and (got it). It will not send an email verification letter to your email until you hit that button. I suspect that one of the ways they combat bots is because they know that some one who sets up a bot account will set the account to auto-pilot after a day or two of no issues. The bot won't notice the pop-up and the account will go unverified for days and days before getting shut down. It is rather clever.

Click to expand...

Shawerma said:

Most anti-detect browsers change your browser fingerprint and other details through extensions they download onto your browser. Reddit can detect the extensions you are using, which makes it easy for them to spot spam bots and potential harmful actors.

Click to expand...

susancan said:

What is your warmup strategy? You must be very experienced

Click to expand...

aurim said:

This is the type of details that are easily overlooked but can play a major factor into account trustiness.

Just that popup alone might no be of a high level of importance in itself, but that, combined with other small ones can make a difference.

Click to expand...

VisualA said:

I was botting reddit last night, going over my code and using playwright to identify links (I'll spare you the boring details).

I use dolphin anty, python and a rotating mobile proxy called iproxy. So far it has been a great setup. So long as I don't do anything stupid, I am 100% undetectable (at least so far). But last night I noticed something rather clever. When you set up a reddit account, they ask for an email. Now, this is nothing new, and emails are by no means difficult to create. Reddit will accept pretty much any email address you give them. However, they do not immediately ask you to verify it. And this is where the sneakiness comes in.

After logging in two or three times, browsing, leaving comments, upvoting, etc... reddit hits you with a popup in the upper right hand corner under notifications. It is small, but easy enough to see if you are a human. The popup just says "Please verify your email" and has two buttons (update email) and (got it). It will not send an email verification letter to your email until you hit that button. I suspect that one of the ways they combat bots is because they know that some one who sets up a bot account will set the account to auto-pilot after a day or two of no issues. The bot won't notice the pop-up and the account will go unverified for days and days before getting shut down. It is rather clever.

Click to expand...

allen_d99 said:

Doesn't reddit send you a verification email as soon as you sign up to it? You can set the bot to click on it and the account will be verified right away.

Click to expand...

VisualA said:

Oh, I'm not. I have only been at this for about two months.

My warmup strategy is three-fold. I did it this way in order to mimic a normal user.

1) Take fifteen minutes to create the account. Browser goes to google, types in reddit, finds the link to reddit, browses for ten minutes (clicks on links, clicks on comments, scrolls, scrolls, scrolls. I love the fake scrolling feature). Opens another tab to my email provider and logs in to it. Spends five minutes on the other tab just touching things. Returns and clicks (Sign up). After that there is a bit of a song and dance. It types one letter at a time into username and password with a randomized pause between each. When it gets to the end it takes a prolonged break and comes back. Finally, the account creation is complete. After that it surfs around for a while, plays with the preferences button, looks through TOS, uses search to browse a few randomized links and then closes.

2) Comes back 1 to 6 hours later and logs in (The Reddit email verification never pops at this stage). From there there is about five minutes worth of random searching, random scrolling and random link clicking. The important part of this stage (at least for me) is to go into preferences and click the 'opt out of redesign'. I do this so that my bots will be on old reddit and not the new mobile reddit. This is important due to bot consistency. My code is geared toward old reddit and not the mobile redesign. Following that, the tab is left open while my bot goes to other tabs and performs other tasks on other sites.

3) Returns thirty minutes later and picks a random sub. It then proceeds to that sub and subscribes to it (and bookmarks it to the browser). It then proceeds to visit every thread in that sub, sort by top comments, upvote the top two comments while scrolling and pausing up and down each thread.

The day after that, I consider the account to be warmed up and set it to a fifteen minutes (per day) rotation where it logs in, inspects a sub, tosses out a random number of upvotes to different comments (One to Fifteen). During the following week is when the account verification popup appears. It typically does not hit during the first week. I'm not sure whether it is on a timer or a counter, but it is obvious that it is trying to catch me off guard.

Click to expand...

VisualA said:

Verification email has not been sent to any of my accounts until after the popup began the process. Check it and confirm it for yourself.

Click to expand...

VisualA said:

Oh, I'm not. I have only been at this for about two months.

My warmup strategy is three-fold. I did it this way in order to mimic a normal user.

1) Take fifteen minutes to create the account. Browser goes to google, types in reddit, finds the link to reddit, browses for ten minutes (clicks on links, clicks on comments, scrolls, scrolls, scrolls. I love the fake scrolling feature). Opens another tab to my email provider and logs in to it. Spends five minutes on the other tab just touching things. Returns and clicks (Sign up). After that there is a bit of a song and dance. It types one letter at a time into username and password with a randomized pause between each. When it gets to the end it takes a prolonged break and comes back. Finally, the account creation is complete. After that it surfs around for a while, plays with the preferences button, looks through TOS, uses search to browse a few randomized links and then closes.

2) Comes back 1 to 6 hours later and logs in (The Reddit email verification never pops at this stage). From there there is about five minutes worth of random searching, random scrolling and random link clicking. The important part of this stage (at least for me) is to go into preferences and click the 'opt out of redesign'. I do this so that my bots will be on old reddit and not the new mobile reddit. This is important due to bot consistency. My code is geared toward old reddit and not the mobile redesign. Following that, the tab is left open while my bot goes to other tabs and performs other tasks on other sites.

3) Returns thirty minutes later and picks a random sub. It then proceeds to that sub and subscribes to it (and bookmarks it to the browser). It then proceeds to visit every thread in that sub, sort by top comments, upvote the top two comments while scrolling and pausing up and down each thread.

The day after that, I consider the account to be warmed up and set it to a fifteen minutes (per day) rotation where it logs in, inspects a sub, tosses out a random number of upvotes to different comments (One to Fifteen). During the following week is when the account verification popup appears. It typically does not hit during the first week. I'm not sure whether it is on a timer or a counter, but it is obvious that it is trying to catch me off guard.

Click to expand...

Svart said:

I agree, Reddit sends me the email right after


your process is impressive, I feel the time you spent crafting it ahahah

I'm not if its the behaviour that a normal user would have when subscribing to reddit

Click to expand...

M4DM4X said:

Your process is very impressive mate, it should have taken a lot of time to code this.
In fact problems start to happen after the warm up period in general, when you begin selling whatever you are selling, redditors are champions to spot marketers. Either through your history, or the way you sell your stuff. In 5minutes poof a week of warm-up is gone.
Anyway I don't know what you are planing to sell there but if your strategy is as smart as your bot then I'm not worried for you
Good luck !

Click to expand...

VisualA said:

Oh, I'm not. I have only been at this for about two months.

My warmup strategy is three-fold. I did it this way in order to mimic a normal user.

1) Take fifteen minutes to create the account. Browser goes to google, types in reddit, finds the link to reddit, browses for ten minutes (clicks on links, clicks on comments, scrolls, scrolls, scrolls. I love the fake scrolling feature). Opens another tab to my email provider and logs in to it. Spends five minutes on the other tab just touching things. Returns and clicks (Sign up). After that there is a bit of a song and dance. It types one letter at a time into username and password with a randomized pause between each. When it gets to the end it takes a prolonged break and comes back. Finally, the account creation is complete. After that it surfs around for a while, plays with the preferences button, looks through TOS, uses search to browse a few randomized links and then closes.

2) Comes back 1 to 6 hours later and logs in (The Reddit email verification never pops at this stage). From there there is about five minutes worth of random searching, random scrolling and random link clicking. The important part of this stage (at least for me) is to go into preferences and click the 'opt out of redesign'. I do this so that my bots will be on old reddit and not the new mobile reddit. This is important due to bot consistency. My code is geared toward old reddit and not the mobile redesign. Following that, the tab is left open while my bot goes to other tabs and performs other tasks on other sites.

3) Returns thirty minutes later and picks a random sub. It then proceeds to that sub and subscribes to it (and bookmarks it to the browser). It then proceeds to visit every thread in that sub, sort by top comments, upvote the top two comments while scrolling and pausing up and down each thread.

The day after that, I consider the account to be warmed up and set it to a fifteen minutes (per day) rotation where it logs in, inspects a sub, tosses out a random number of upvotes to different comments (One to Fifteen). During the following week is when the account verification popup appears. It typically does not hit during the first week. I'm not sure whether it is on a timer or a counter, but it is obvious that it is trying to catch me off guard.

Click to expand...

VisualA said:

This is very true and I genuinely suspect reddit uses some form of trust score.

They have 'reddit approved' bots on their platform. There are even novelty subs that are full of them. Many moderators use bots to moderate their subs in fact. Combine this with the fact that Reddit benefits from the increased traffic and often holds up its account creation statistics as something to be proud of... and they would find themselves in quite a dilemma.

The issue, I suspect, is not with 'botting' as a practice. Instead, I suspect it is with bad actors. People who want to use their platform to advertise, brigade or manipulate. At the end of the day, we should pause for a moment and recognize that admins are not enforcing these policies. These are bots. Bots trying to catch bots. They have automated their moderation practices. So long as we do not offend (whatever subroutine handles) the trust score... we will be completely indistinguishable from genuine users.

If none of our practices or browser settings seem suspicious then there is nothing suspicious about us. If no sub mods complain about us then there is nothing that needs to be done. We blend in.

Click to expand...

VisualA said:

This is true, dolphin anty enables people to compile separate extensions into 'profiles' that will then only be used for that particular browser profile. My code does not always need to log in. Often times, after visiting, reddit remembers that particular browser instance as the account name it was registered under and simply logs it. It recognizes the extensions and the mac address and says "Oh, you are obviously this account, no need to log in." Very handy and it gives me a little extra assurance that they are completely fooled.

Click to expand...

VisualA said:

I was botting reddit last night, going over my code and using playwright to identify links (I'll spare you the boring details).

I use dolphin anty, python and a rotating mobile proxy called iproxy. So far it has been a great setup. So long as I don't do anything stupid, I am 100% undetectable (at least so far). But last night I noticed something rather clever. When you set up a reddit account, they ask for an email. Now, this is nothing new, and emails are by no means difficult to create. Reddit will accept pretty much any email address you give them. However, they do not immediately ask you to verify it. And this is where the sneakiness comes in.

After logging in two or three times, browsing, leaving comments, upvoting, etc... reddit hits you with a popup in the upper right hand corner under notifications. It is small, but easy enough to see if you are a human. The popup just says "Please verify your email" and has two buttons (update email) and (got it). It will not send an email verification letter to your email until you hit that button. I suspect that one of the ways they combat bots is because they know that some one who sets up a bot account will set the account to auto-pilot after a day or two of no issues. The bot won't notice the pop-up and the account will go unverified for days and days before getting shut down. It is rather clever.

Click to expand...