InvestigationMarch 15, 202611 min read

Deleted Reddit History, Active Radicalization: An OSINT Case Study

An OSINT case study reconstructing an active radicalization timeline from a deleted Reddit account, using a 30 billion post archive that preserves removed content.

THINKPOL

Deleted Reddit History, Active Radicalization: An OSINT Case Study

During a routine scan of archived user pools from banned Reddit communities, our system flagged a deleted French account with 380 comments and 19 submissions spread across 57 subreddits over 101 days (December 2023 to March 2024).

On the surface: a young French male, 18-25, interested in fashion replicas, Arabic language learning, music production, facial aesthetics, and GTA outfits.

Underneath: 39 comments on r/masskillers. 30 on r/extomatoes. 11 on r/fosscad. 6 on r/zorakiconversion. 6 on r/Sunni. Activity on r/islamic_jihadists. Detailed technical knowledge of European firearms black markets. Explicit defence of ISIS operational strategy. Expressed desire to produce nasheed audio. And a trajectory that accelerates week by week.

None of this is visible on Reddit today. The account is deleted. The communities are banned. Every trace is gone.

The data

Three API responses. 19 submissions. 380 unique comments. Activity across 57 subreddits over 80 active days.

The username has been redacted throughout. All quotes are verbatim from the archived data. Timestamps are UTC.

We categorised the 380 comments by context:

Threat-related (r/masskillers, r/fosscad, r/zorakiconversion, r/islamic_jihadists): 57 comments

Ideological(r/extomatoes, r/Sunni, r/boringdystopia): 37 comments

Culture war / anti-Western (r/Consoom, r/francophonie, r/prime): 40 comments

Lifestyle / normal (r/FashionReps, r/Mewing, r/GTAoutfits, r/learn_arabic, r/Mode, r/AskMec, r/AskFrance, r/linguisticshumor, r/wordington): 139 comments

Other: 107 comments

The first thing that matters is the ratio. Roughly 35% of this user's total output falls into threat, ideological, or anti-Western categories. The remaining 65% is indistinguishable from any young French man online. Fashion opinions. Dating advice. Mewing tips. Memes.

That mixture is the point. It's what makes this kind of profile invisible to keyword-based monitoring. You won't find it by searching for "jihad" or "attack." You find it by reconstructing the full picture and reading the trajectory.

Phase 1: December 2023. The mass violence researcher.

The earliest archived activity begins on December 21, 2023. The first community of concern to appear is r/masskillers, a subreddit dedicated to discussing mass shootings, their perpetrators, and their methods.

By December 23, the user is already demonstrating subject-matter depth. Commenting on Czech firearms laws, he writes: "Czechia have very laxist gun laws in comparison to the rest of Europe." When challenged, he adds: "I didn't say it was a bad thing." In the same thread: "The fact is that someone that wants to kill, will kill. We have seen multiple times that cars or trucks can be as effective... or bombs."

That framing matters. He is not expressing horror. He is evaluating methods.

On December 24, Christmas Eve, he posts 15 comments. Among them, on r/masskillers, he defends ISIS-affiliated attackers against another Muslim user trying to distance Islam from violence: "Why are you trying to lick their boots? You are trying so hard to have their validation, make Islam west-friendly that you even say false things about Islam. Fear Allah. Scholarly speaking, khawarij (if you consider them as such) are still considered Muslims, and that's by the majority of scholars, so you can't takfir them."

That same evening, on r/france, he writes a series of comments about Maghrebi comedians who mock their own community to entertain French audiences, calling them "bootlickers" and "buffoons." He identifies as Franco-Maghrebi but explicitly rejects French identity: "Never once was I considered French even though I have the origins, so I can't even imagine for non-French people who have no connection to France apart from a poor piece of paper."

On r/exmusulmanfrance, he compares the Islamic penalty for apostasy to American treason laws: "At the same level that Western countries punish treason. In the USA, it's the death penalty."

Within a single day, the profile reveals: familiarity with mass violence methodology, defence of jihadist actors within Islamic theological framing, identity alienation from France, and normalisation of capital punishment for leaving Islam.

And interleaved with all of it: memes, dating subreddit replies, and fashion comments.

Phase 2: January 2024. The convergence.

January is when the profile transforms. Three tracks that had been developing in parallel begin to merge.

The weapons track

On January 7, he appears in r/zorakiconversion, asking about a specific blank-firing pistol model. On January 8, he follows up: "The chamber doesn't seem to be weakened so you just follow the normal process. Where did you buy it though? I like its design a lot." He's not asking theoretical questions. He's assessing a specific weapon for convertibility.

On January 9, on r/masskillers, he writes a comment that stopped us during analysis. Discussing the weapons used in the November 2015 Paris attacks, he corrects another user: "Those aren't AKs, they are VZ-58, more precisely obtained through Slovakia, where 'Expanz' VZ-58 were sold without restriction. Those Expanz VZ-58 are converted to shoot blank ammo, but can easily be made to shoot live ammo again, and it was done regularly in Belgium by traffickers." This comment received 43 upvotes.

That's not Wikipedia-level knowledge. That's a detailed understanding of the specific supply chain used in the deadliest terrorist attack on French soil. He knows the weapon model, the country of origin, the brand name of the converted variant, the conversion process, and the trafficking route through Belgium.

On January 14, he identifies a Retay PT 23 blank-firing pistol from an image in a r/masskillers thread, validating another user's identification: "Good eyes, I know a bit about Retay and I validate your identification." On January 25, he discusses Amedy Coulibaly's body armour during the Hyper Cacher attack, linking to a Le Point article.

On r/fosscad, across January and February, he asks about magazine names, discusses VZ-58 internals, inquires whether a Roni conversion kit is 3D-printed, and comments on wall thickness for printed components. On March 24, in his last r/fosscad comments, he recommends another user "look into the recoilless launcher the IRA made" and writes: "Western countries' laws are such a joke with stupid bloated restrictions. I hope you find a working workaround."

The ideology track

January 28 is the single highest-concentration day of ideological content. 16 comments, 11 of them on r/extomatoes and r/Sunni.

On r/Sunni: "Enraging them is the least we can do against kuffar, let them hear what will set them off."

On r/Sunni: "They [Shia] were working hand in hand with the Americans. Rafidah hate Muslims. They are like the Jews toward us. We should NEVER take them as allies."

On r/extomatoes, in a sustained argument defending ISIS against other Muslims, he writes: "You hate them because Western media told you so, the same media that always targets Muslims, and we should believe them when it's ISIS? 'The mujahideen have done this and that wrong' while you are sitting in your couch comfortably while being in a Western country. Look at yourself before talking."

And then the comment that reveals strategic understanding: "I never saw a media of Daesh where this opinion was held. They are well aware since 2014-2015 that it is not an option for Muslims in Western countries. They don't make takfir of Muslims in Western countries. In fact, they went from bringing soldiers from the Middle East to make operations in Western countries, to calling the Muslims already in Western countries to make operations."

That's not sympathy. That's an articulation of how ISIS evolved its operational model from external dispatch to domestic activation. He is explaining their strategy with the familiarity of someone who has studied it closely.

On r/Histoire, the same day, when confronted: "That response reeks of weakness. In real life, do you lower your eyes when you see a bearded man or not?"

The cultural rejection track

Throughout January, on r/francophonie, he argues that true Islamic governance means sharia law, that a genuine Muslim "would prefer to live in a piece of desert administered by sharia rather than in an ultra-rich society with hundreds of cosmopolitan degenerate megacities." He predicts Algeria will eventually be governed by Islam, not its current "senile generals," and tells French commenters: "Millions of Muslims killed and we shouldn't hold it against you?"

On r/Consoom: "I have enmity towards every piece of cultural goods that Western countries produce."

On r/Histoire, January 13: "All these fights by Westerners against Islam, only to eventually become Muslim countries through demographics."

Phase 3: February-March 2024. Operational capability.

In February, the profile adds two new dimensions.

On February 10, across r/WeAreTheMusicMakers, r/ableton, r/FL_Studio, r/trapproduction, and r/FLStudioBeginners, he posts the same message to five music production subreddits on the same day: "How to do this type of voice effect? Like in the first seconds? The voice has a lot of bass and tremble but I can't find how to reproduce that. This is often used in nasheed."

He includes a Streamable link as reference audio. Nasheeds are the Islamic chants used prominently in jihadist propaganda videos, from ISIS recruitment material to execution footage. He is trying to learn how to produce this content.

Across r/MilSim, r/tacticalgear, and r/airsoft, he asks how many MP5 or Glock extended magazines fit in a SMERSH chest rig. That's a Russian military load-bearing system. Cross-referencing with his January 25 comment about Coulibaly's "Russian/Soviet body armour," the interest in Russian military equipment appears consistent.

On r/zorakiconversion, February 21, he asks a user: "No Telegram?" and follows up with a thumbs-up emoji. He's attempting to move the conversation to an encrypted platform. Earlier, in a submission on the same subreddit, he had already tried to reach a suspended user via Telegram.

On r/islamic_jihadists, February 18: "Sad that this is in Arabic. I'm in the process of learning Arabic but it's hard and long, insha'Allah one day I will be able to understand Arabic."

On r/codeine, he posts asking about a European vendor.

By late March, the last archived comments show him recommending IRA-designed weapons on r/fosscad and calling French users' concerns about Islam "just fear, nothing more."

Then the account goes dark. Everything is deleted.

What this profile looks like through a research lens

This isn't the first profile of its kind. It maps onto patterns that European counterterrorism agencies and academic researchers have documented extensively.

France's domestic intelligence service (DGSI) reports that 70% of suspects detained for involvement in terror plots are now under 21. In 2024, 18 minors were prosecuted for terrorism offences in France alone, up from two in 2022. French authorities flagged a 15% increase in radicalization alerts over 2025.

The EU Knowledge Hub on the Prevention of Radicalisation describes the current trend: radicalised youth are getting much younger, the process increasingly occurs online, and digital-native adolescents drift from edgy content to extremist communities through incremental exposure, often under the cover of humour and memes.

Academic research on Muslim youth radicalisation in France (Robert & Kaya, 2024) identifies two key drivers in interviews with young French Muslims of Maghrebi descent in Paris and Lyon: estrangement from mainstream societal values, especially laïcité, and dissatisfaction with the political-institutional system. Both are explicit in this user's posts. His r/francophonie and r/france comments express rejection of French identity despite partial French heritage, contempt for secular morality, and the view that demographic change will make the political fight irrelevant.

RTI International's analysis of ghost gun conversations on Reddit found that one in three posts focused on building or acquiring untraceable firearms, and that users form knowledge-sharing relationships across subreddits. That matches what we observe here: the user moves between r/fosscad (3D-printed weapons design), r/zorakiconversion (blank-to-live firearm conversion), and r/masskillers (European firearms black market knowledge), building a composite understanding from multiple communities.

The Soufan Center notes that radicalization timelines have compressed dramatically due to online propaganda. But this user's trajectory, 101 days from first archived comment to account deletion, was not instantaneous. It was progressive, traceable, and visible. The signals were in the data. Nobody was looking.

The interleaving problem

The most analytically important feature of this profile is not the extremist content. It's the mixture.

On January 9, the same day he wrote a detailed technical breakdown of the Paris attack weapons supply chain on r/masskillers, he also posted dating advice in French on r/TropPeurDeDemander and told someone on r/Consoom their jokes were overused.

On January 28, between defending ISIS and denouncing Western kuffar on r/extomatoes, he posted on r/FashionReps and r/Mode.

On February 18, the day he commented on r/islamic_jihadists expressing frustration that content wasn't available in French, he also discussed Stable Diffusion prompts and torrent use.

This is what makes behavioural detection hard and keyword monitoring useless. The signal is not in any single comment. It is in the trajectory across 57 subreddits over 101 days, and in the convergence of three tracks that, individually, might each look like curiosity. Together, they look like preparation.

A system that only sees what exists on Reddit right now would find nothing. A system that searches for keywords would drown in noise. What's needed is a system that reconstructs the full behavioural arc, including deleted content, and identifies the pattern of convergence.

What's gone now

The user's account is deleted. Every comment, every submission, every trace of activity has been removed from Reddit.

The subreddits where the most critical activity occurred, r/fosscad, r/zorakiconversion, r/islamic_jihadists, have been banned by Reddit. Even if the account still existed, the community context would be gone.

Our archive preserved the full record because we capture in real time, before edits and deletions occur. The archive currently holds roughly 28.5 billion data points from Reddit, including an estimated 30% of content that no longer exists on the platform.

This person could walk into any background check, any screening process, any standard OSINT investigation, and come out clean. His digital footprint on Reddit is zero.

In our system, every comment cited in this article still exists.

A note on methodology

This investigation was not prompted by a tip, a case referral, or a known suspect. It was the output of routine automated scanning of archived user pools from communities flagged for threat-relevant content.

The multi-LLM analysis pipeline cross-references content across communities, identifies thematic convergence, and scores behavioural trajectories over time. The human review that followed confirmed and structured what the system surfaced.

We are not a law enforcement agency. We do not make determinations about criminal intent. What we provide is the intelligence layer that allows investigators, analysts, and security teams to assess profiles that would otherwise be completely invisible.

The profile described in this article was generated through standard THINKPOL API queries. The username has been anonymised. The data is real.