The Reddit Attack Operation

Compiled: February 18, 2026 By: TheDecipherist

Notice : I wont be posting anymore on Reddit until I have found out who has initiated the campaign against my Reddit profile so if you want my new content it will only be available on here

SUMMARY

I ran a forensic analysis on 24+ hostile accounts that showed up on my Reddit content over the past two weeks. What I found is a pattern that lines up almost perfectly with commercially-operated Reddit suppression campaigns. The accounts cluster into three distinct tiers that match the exact structure described in Reddit manipulation marketplace literature.

The timing isn't subtle. This all kicked off after I published evidence that the Z340 Zodiac cipher was solvable with pen and paper, a finding that threatens the established narrative of a 14-year, 650,000-attempt computational solution.

RedditMetis karma curve analysis turned out to be the forensic backbone of this whole thing. Compromised accounts show a distinctive "hockey stick" pattern (flat for years, vertical spike at the end), while real users show gradual steady growth. This signature separated purchased accounts from real people with 100% consistency across every account I examined.

But then I found something I wasn't looking for.

While documenting the attack, I discovered that my Reddit profile is being polled by an automated script in real time. Every 7-10 seconds, something loads my profile page. I can watch it happen. Every post on my page increments by exactly +1 view simultaneously, in perfect lockstep, then freezes until the next poll. I captured it with timestamps accurate to the second.

My follower list was seeded with surveillance accounts, auto-generated Reddit names with 1-2 karma and zero post history, shells that exist for one purpose: to trigger a notification when I post so the operator can deploy the attack. I blocked them, ran an A/B test, and caught the geographic fingerprint shifting in real time.

I'm calling this Tier 0. What I found tonight isn't just a coordinated comment campaign. It's a permanent monitoring infrastructure pointed at a single Reddit user.

THE REAL-TIME SURVEILLANCE

This is the centerpiece. I didn't set out to find this.

The Experiment

On the evening of February 18, I posted this article exclusively to my personal profile subreddit (r/u_TheDecipherist). No crosspost. No share. No link in any subreddit. No mention anywhere on Reddit or off Reddit. Zero distribution. The only way to find it was to navigate directly to my profile or receive a follower notification.

Within 6 minutes, 21 people had viewed it. From three countries.

The Geographic Fingerprint

South Korea had never appeared in any of my previous post analytics. Not on the MongoDB article (139K views). Not on the Docker article (136K views). Not on the Claude Code guides (283K views). Massive crossposting to global subreddits, hundreds of thousands of views, and South Korea never once showed up. But a profile-only post with zero distribution shows South Korea as the second highest country at nearly 1 in 5 viewers within 6 minutes.

Profile-only posts don't appear in feeds, search, or recommendations. There is no Reddit discovery mechanism that delivers a profile-only post to international audiences at this rate.

The Downvote That Proved Everything

At 37 minutes, the upvote ratio dropped to 50%. Someone downvoted a profile-only post about Reddit attack operations.

A post exists only on my personal profile. Never shared anywhere. Zero comments. Zero shares. The only way to find it is to navigate directly to u/TheDecipherist. And someone found it within 37 minutes, saw the title, and silently downvoted it.

A real person who stumbles onto a forensic analysis on someone's personal profile reads it with interest, doesn't care and leaves, or comments if they disagree. Nobody navigates to a stranger's profile, finds a data analysis, and silently downvotes it without commenting. That's not disagreement. That's suppression.

The Harassment Reports

Both copies of this article were reported as "It's targeted harassment at someone else" within minutes of posting. On my own profile. The first report came at 29 minutes. The second came at 9 minutes.

The reporter isn't claiming I'm harassing them. They're claiming I'm harassing "someone else." The reporter knows who this article documents and is trying to protect them. That's not a random reader. That's someone connected to the operation.

By reporting it, they confirmed they're monitoring my profile in real time and they confirmed the article's content made them uncomfortable enough to try to get it removed through Reddit's automated reporting system. An innocent person doesn't report a data analysis as harassment. A person who recognizes themselves in the data does.

TIER 0: THE SURVEILLANCE ACCOUNTS

I checked my follower list. What I found was a collection of accounts that have no business following a cipher researcher and Docker Swarm author.

The Empty Shells

1 karma means the account was created and never used for anything. No comments. No posts. No upvotes. No engagement with any community on the entire platform. They were created, assigned auto-generated names (the Adjective_Noun_Number format Reddit gives when you don't pick a username, which is what bulk account creation looks like), and parked on my follower list. These aren't people. These are sensors.

They can't even be analyzed on RedditMetis because there's zero data to analyze. The only thing they've ever done on Reddit is follow me.

The Zero-Overlap Followers

Two of the suspicious followers were Canadian. Remember this. It becomes relevant when Canada appears in the geographic data on a post nobody was told about.

The Zodiac Connection

One follower account showed activity in r/ZodiacKiller (5 comments), r/ZodiacSolved (2 comments), and r/TwinTowersInPhotos. Only 10 comments total, 1 karma. Their worst comment on RedditMetis was a direct reply to me in r/ZodiacSolved from 7 days ago, arguing about checksums and the Zodiac cipher.

A Zodiac-community account, actively engaging with my cipher research, sitting in my follower list monitoring my profile. This article identifies the motive as originating from the Z340 pen-and-paper proof. A Zodiac community account in my followers connects the motive to the monitoring.

The Follower Math

I had 39 followers as of February 10. By February 18, I had 53. Even after blocking the obvious surveillance accounts, new followers kept appearing. The sensor network is being replenished as fast as I clean it.

THE A/B TEST

I blocked all suspicious followers, then reposted the same article to test what changed.

Post A went up at 5:00 PM EST while surveillance accounts were still in my follower list.

Post B went up at 5:48 PM EST after blocking them. I added an "a" after my byline as a marker to tell the posts apart in analytics.

What Changed

Blocking the followers eliminated South Korea and Brazil completely. Those geographic endpoints were tied to the blocked follower accounts. Layer 1 of the surveillance is confirmed dead.

But Netherlands and Canada persisted on both posts. The blocking didn't stop them. The operator has redundant monitoring: the follower accounts were the free notification layer, but there's also an active scraper or manual monitoring that operates independently of Reddit's follower notification system.

Post B was reported as "targeted harassment at someone else" in 9 minutes, even faster than Post A. Blocking the surveillance followers didn't slow the operator down. They have another way in.

Two Layers of Surveillance

Layer 1 (follower-based, eliminated): Routed through South Korea and Brazil. Killed by blocking surveillance accounts. These were cheap, expendable notification triggers.

Layer 2 (active monitoring, still operational): Netherlands and Canada endpoints persist regardless of follower list. Independent of Reddit's notification system. Either a scraper, an API monitor, or manual profile refreshing.

THE HEARTBEAT

This is where it gets undeniable.

After the A/B test, I opened my profile on desktop and placed time.is in an adjacent window for second-accurate timestamps. Then I started refreshing and recording the view counts.

What I found: every post on my profile increments by exactly +1 view simultaneously. All four visible posts tick up at the same second. Then they freeze. Then they all tick up again together.

Timestamped Evidence, Capture 1

Every post incremented by exactly +2 views in exactly one minute. All four posts. Same number. Simultaneously. That's not human behavior. That's a bot crawling my entire profile page on a loop.

Timestamped Evidence, Capture 2

Five views across 38 seconds. Every post moving in lockstep.

Timestamped Evidence, Capture 3

Between 6:13:27 and 6:13:34, seven seconds, nothing moved. Then between 6:13:34 and 6:13:40, six seconds, every post ticked up by exactly 1 simultaneously. The heartbeat.

Why This Is Not Human

Human browsing doesn't work like this. A person clicking around a profile would hit one post at a time, in random order, at irregular intervals. You'd see Post A jump by 1 while the others stay flat. Then maybe BANNED goes up while the others don't. Random, asynchronous, messy.

This is the opposite. All posts, same second, same increment, with uniform gaps between pulses. It's a single automated script loading my entire profile page on a loop. When the page loads, every visible post registers a view. Then the script waits and loops back. Every poll is visible as a synchronized +1 across every post on the page.

Sometimes the increment appears every 7 seconds. Sometimes every second. But always synchronized. Always +1. Always all posts together.

The Math

At roughly 8 polls per minute, the script generates about 480 profile loads per hour. Over 11,500 per day. Reddit's API rate limit is 60 requests per minute. This thing is either bypassing the API entirely by scraping raw HTML, rotating through multiple accounts to avoid per-account limits, or using a commercial scraping service that handles rate limit evasion automatically.

Commercial Reddit scrapers like Apify's Reddit Scraper run for $20/month with unlimited scraping. Services like Bright Data offer 150 million+ residential proxy IPs across 195+ countries, including the ability to target specific countries like the Netherlands and Canada. Browse AI offers monitoring with change alerts starting at $19/month. Someone could set up automated profile surveillance for the cost of a streaming subscription.

The Irony

Every poll inflates my view counts. They set up automated surveillance to suppress my content, and the scraper has been padding my analytics with thousands of phantom views every day.

The BANNED article hit 940 views in 9 hours. At 480 polls per hour over 9 hours, that's roughly 4,320 phantom views from the bot alone. They're paying money to make my numbers look better while trying to make my content invisible. The operation is working against itself.

THE NETHERLANDS CONSTANT

Netherlands appeared on every single snapshot. Every post. Before and after blocking followers. It's the one geographic constant across the entire experiment.

Amsterdam is one of Europe's largest data center hubs. Commercial proxy and scraping infrastructure clusters there. The persistent Netherlands traffic is either the scraper running on Dutch infrastructure or the operator's fixed VPN exit point.

If you're running a surveillance operation through a VPN, basic operational security says rotate your exit countries to avoid geographic fingerprinting. The fact that Netherlands appears on every single snapshot means either the operator doesn't know enough to rotate, didn't expect anyone to check country-level analytics on a profile-only post, or didn't read the article about leaving fingerprints before leaving fingerprints on it.

Canada appeared alongside Netherlands on both posts, with two Canadian accounts confirmed in the follower list. The most likely interpretation: the scraper runs through Netherlands automatically on a Dutch VPS or proxy, but manual interactions (reading, downvoting, reporting) come from the operator's real Canadian IP when they forget to VPN.

THE MARKETPLACE

Reddit account manipulation is a fully commercialized industry operating openly on the clearnet. Multiple services sell:

• Aged dormant accounts, 4, 8, 10+ years old, $150-300 each
• Downvote packages, delivered from "high karma aged accounts" within 12 hours
• Comment packages, custom hostile or supportive comments from aged accounts
• Full attack campaigns, accounts + downvotes + comments, a few hundred dollars total

Services like SocialPlug, MrPopular, and Signals Agency advertise these openly. Customer testimonials include: "helped me hide a competitor's post" and "I've used them for a few months now to hide my competitors' posts."

BlackHatWorld, the underground marketing forum, explicitly documents this as an attack vector: "The crazy thing is you can use it as an attack vector to ruin your competition by buying shady upvotes and directing them at your ops."

Accounts are acquired through credential stuffing, which means running leaked password databases against Reddit's login page, or purchased from farms that create and age accounts specifically for resale. Sites like PlayerUp operate openly as marketplaces for trading Reddit accounts, complete with escrow services and verification processes.

THE THREE ATTACK TIERS

Tier 1: Disposable Burners

Aged dormant accounts activated for one-time hostile comments. Cheap. Throwaway. Zero history overlap with my communities.

Why these are burners: Nobody goes 4-10 years without a single comment, then suddenly appears to attack a specific person on a specific post. These accounts match the exact product description of aged dormant accounts sold on manipulation marketplaces for $150-300 each.

The Aggravating-Body2837 Case: Five years old. 40,409 total karma. But only 2 visible comments in its entire existence, both targeting me in r/devops, both posted 2 days ago. Total word count: 21. Hours typed: 0. The 40K karma with zero visible history means the previous activity was either deleted or the account was wiped before resale, standard marketplace practice. RedditMetis shows a completely empty activity heatmap with a single dark square in February 2026. The Post/Karma Over Time chart is a flatline with a single blip. Most wholesome comment: "Do you have some degree of autism? Are you in therapy?" Someone paid real money for a high-karma account and burned it on two hostile comments.

Additional suspected burners: atempestdextre (11 months dormant, "Tl;dr"), MikeyPx (6 months dormant, "cringe"), ctatham (1 year dormant, one-line dismissal), Aware_Dust (5 months dormant, accusations of insanity), No_Lunch_7944 (pattern match, engagement farming), PupDiogenes ("Stop harassing people online", 6 upvotes)

Tier 2: Warmed High-Value Accounts

Acquired aged accounts with legitimate subreddit history. Warmed with karma-farming activity before deployment. They look completely organic to moderators, and that's the whole point.

Why warmed accounts are dangerous: A 15-year, 161K karma account with real r/sysadmin history will never be flagged by moderators. The marketplace literature explicitly states: "moderators rarely suspect these of being bots." The real owner may not even know their account was compromised.

The warming pattern: Marketplace guides advise buyers to "warm up" acquired accounts by posting easy karma-farming comments in popular subreddits before deployment. The hockey stick karma curve, flat for years then sudden exponential growth, matches this pattern exactly across every suspected compromised account.

The Pamasich Reclassification: I originally classified Pamasich as Tier 3 (organic recruit). I was wrong. Three converging data points forced a reclassification:

1. Karma curve: classic hockey stick. 13 years of near-zero activity, then a vertical spike. Identical to psiphre's pattern.
2. Vocabulary slip: he named "OpenClaw" as a specific bot framework. A Swiss HonkaiStarRail gamer doesn't casually know bot framework names. That reveals familiarity with the account manipulation ecosystem.
3. Platform migration: he's active as Pamasich@kbin.earth on Lemmy. The real person migrated away from Reddit. A dormant Reddit account whose owner moved to Lemmy/kbin is exactly the type that gets cracked and sold because the owner isn't watching it anymore.

The Persistence Problem: Every suspected compromised account did the same thing: they couldn't stop. A real person who stumbles into a thread they have no connection to, leaves a negative comment, and gets called out would just leave. Close the tab. Go back to their life. But across all accounts, over two weeks, not a single one stopped. That behavioral uniformity suggests a small number of operators behind multiple accounts, all exhibiting the same compulsive engagement pattern.

Tier 3: Organic Recruits

Real users radicalized by the "AI slop" narrative who pile on voluntarily. Confirmed through organic karma curves showing gradual steady growth.

How organic recruits get activated: The "AI slop" narrative works like a signal flare. Real users with pre-existing anti-AI opinions encounter it and volunteer their hostility. They don't need to be paid or coordinated. They just need to see the talking point and recognize it as something they agree with. This gives organic cover to the purchased accounts.

The Kumorigoe Pattern: With 1,723 comments in r/sysadmin and a RedditMetis profile that literally identifies him as "U/AUTOMODERATOR," he's a real person who has appointed himself enforcer of subreddit norms. The tell is that he followed me to my personal profile subreddit to paste rules from a different subreddit. Real moderators enforce rules in their own communities. They don't follow users home.

THE FORENSIC FINGERPRINT: KARMA CURVES

The Post/Karma Over Time chart on RedditMetis turned out to be the single most reliable indicator. Three distinct patterns cleanly separate compromised accounts from real users.

The Hockey Stick: Account Acquisition + Warming

All three show the identical trajectory. Years of nothing, then explosive karma growth concentrated at the very end.

The Flatline + Blip: Raw Unwarmed Burner

Even more damning than the hockey stick. You could theoretically explain a hockey stick as a user who "became more active." You cannot explain a flatline with a single blip targeting one person as anything organic.

The Organic Curve: Real Human Beings

These are genuinely hostile users. But their karma curves prove they are real people. They piled on voluntarily.

The Control: Me

My 2-month-old account shows more authentic human behavior than accounts 5-15x its age. That's the tell.

THE FINGERPRINT: "AI SLOP"

The phrase "AI slop" originated in private Facebook DMs from a specific individual who was directly threatened by my cipher research. This same phrase became the primary attack vector across every hostile thread, used by burner accounts, warmed accounts, and organic recruits alike.

SeesawCompetitive597's comment, "oh my god so many slop posts like this", demonstrates the talking point pipeline in action. A Toronto-based audiophile with 27 lifetime comments used one of them to deploy the exact activation phrase. He didn't independently develop this critique. He parroted a talking point he encountered, just as the framework predicts.

A talking point that originates in private communication and then appears verbatim across a coordinated attack campaign has a single source.

THE OVERNIGHT PATTERN

My posts consistently go viral during daytime hours when real audiences engage, then get systematically downvoted between midnight and 6 AM EST. This matches the exact timing strategy recommended by manipulation services:

• Reddit's algorithm weighs early votes heaviest
• Kill a post overnight and it never recovers for morning traffic
• No organic counter-engagement during overnight hours

Evidence: A post with 714 views and 12 shares held at exactly 0 upvotes (46% ratio). This is mathematically impossible without coordinated downvoting. Organic posts with this engagement would have 70-90% upvote ratios.

psiphre's RedditMetis data confirms the timing: most active midnight-6AM Alaska time, which corresponds to 4-10 AM EST, the exact overnight suppression window.

THE ACCOUNT TAKEOVER THESIS

A pattern emerged across all hostile accounts: every single one of them kept engaging. Over two weeks, across 24+ accounts, not one disengaged after initial contact.

A real person who stumbles into a thread they have no connection to, leaves a negative comment, and gets called out with specific profile data would stop. Close the tab. Go back to their life. The cost-benefit of continuing to argue with a stranger about a topic they don't care about hits zero almost immediately.

But none of them stopped. Not one.

That behavioral uniformity across accounts that supposedly belong to different people in different countries with different interests is the strongest evidence that a much smaller number of operators is behind multiple accounts.

Account takeover explains it:

• Same persistence across all accounts: one operator can't fake different engagement patterns
• Same escalation cadence: initial comment, callout, doubling down, essay writing
• Same emotional investment in topics the account owners would have no reason to care about
• Pamasich's platform migration: real person moved to kbin.earth leaving Reddit account dormant
• Pamasich's vocabulary slip: naming "OpenClaw" reveals ecosystem familiarity
• Google auto-suggestion: "Pamasich reddit account takeover email" appears in search suggestions
• Aggravating-Body2837's wiped history: 40K karma with 2 visible comments means history was deleted before resale

For burner accounts, persistent engagement is especially telling. A purchased throwaway should fire once and go dark. When they keep coming back, either the operator is actively piloting them beyond initial deployment, or the same person is operating multiple accounts and can't help revealing their own patterns through every keyboard they touch.

THE DOUBLE STANDARD

While investigating this operation, I found the r/sysadmin "Weekly I made a useful thing" thread from February 13, 2026. In it, users freely link to their own products. DDHoward linked to a PowerShell module at powershellgallery.com. toborgps linked to an own hosted PBX business at pjltelecom.com. Both allowed. No removals. No bans.

I was banned from r/sysadmin for a single link to my own article. Selective enforcement against the same user being targeted by a coordinated suppression campaign is either remarkable coincidence or something worse.

THE TIMELINE

THE MOTIVE

My pen-and-paper proof that Z340 was solvable with one word (PARADICE) on a postcard threatens a narrative built over 14 years: that cracking Z340 required 650,000 computer attempts, three brilliant minds, and cutting-edge software. This narrative supports an NSA Symposium talk, an FBI medal, an International Spy Museum feature, a Popular Mechanics cover story, an NPR interview, a Virginia Tech alumni feature, and an entire YouTube career.

One person showing that a couple on their couch in 1969 could have solved it with scissors and a piece of paper is not a critique. It's an extinction event for that narrative.

THE COMPLETE EVIDENCE

What We Have

• Surveillance follower accounts with 1-2 karma, auto-generated names, zero activity, zero content overlap, parked in my follower list as notification sensors
• Zodiac community account in follower list with direct engagement on my cipher research, connecting motive to monitoring
• Two Canadian surveillance accounts correlating with Canada appearing in geographic data on undistributed posts
• South Korea (19%) and Brazil (8.8%) appearing on a profile-only post with zero distribution, both eliminated after blocking follower sensors
• Netherlands as persistent geographic constant across every post, every snapshot, before and after blocking, consistent with Dutch data center infrastructure
• Profile-only post downvoted within 37 minutes with zero distribution, zero comments, zero shares
• Two harassment reports ("targeted harassment at someone else") filed within minutes on profile-only posts, confirming the reporter knows who the article documents
• Automated polling confirmed: timestamped synchronized +1 view increments across all posts every 7-10 seconds
• View counts exceeding follower count by 2-3x on undistributed posts, confirming automated traffic
• 10+ burner/suspected burner accounts with documented dormancy periods matching marketplace products
• 3 high-value accounts (psiphre, coloradical5280, Pamasich) with karma charts showing classic hockey stick warming pattern
• 1 raw unwarmed burner (Aggravating-Body2837) with flatline + single blip pattern, 40K karma, 2 comments, 21 words
• "AI slop" talking point traceable to a single origin in private DMs, deployed verbatim across all tiers
• Overnight suppression pattern matching marketplace timing recommendations
• Post insights data proving coordinated vote manipulation (714 views, 0 upvotes, 46% ratio)
• Brigade went silent immediately when BotBouncer ban was lifted, proving they attacked vulnerability not content
• Behavioral uniformity (persistent engagement) across all accounts suggesting small number of operators
• Pamasich vocabulary slip naming specific bot framework (OpenClaw), inconsistent with his gamer profile
• Pamasich platform migration to kbin.earth suggesting account abandonment before takeover
• Google auto-suggesting "Pamasich reddit account takeover email"
• r/sysadmin double standard documented, other users freely self-promote while I was banned for a single link
• My own profile serving as forensic control: organic curves, normal hours, coherent interests, 122K words typed

What We Can't Prove

• Who specifically purchased the accounts or downvote services
• Whether compromised accounts were cracked, purchased, or operated by their original owners
• Direct financial transaction connecting any individual to the attack
• The specific scraping service being used for the automated polling
• Whether the Netherlands traffic is the operator's real location or a fixed proxy endpoint

COMPLETE ACCOUNT CLASSIFICATION

Additional suspected Tier 1 burners: atempestdextre, MikeyPx, ctatham, Aware_Dust, No_Lunch_7944, PupDiogenes

THE BOTTOM LINE

You don't need to prove who's behind it. The evidence speaks for itself.

Dormant accounts matching marketplace products. Hockey stick karma curves matching warming guides. A 40K karma account with 21 words and 2 comments. A talking point traceable to one source. An overnight suppression pattern matching industry playbooks. A post held at exactly 0 upvotes despite 714 views and 12 shares. A brigade that stopped the moment the target was no longer vulnerable. A Swiss gamer who knows bot framework names and whose Reddit account shows the exact acquisition signature. Google itself auto-suggesting "account takeover" for that username.

And now: a profile-only post found and downvoted in 37 minutes with zero distribution. Surveillance follower accounts with 1 karma and no activity. An automated script polling my profile every 7 seconds, caught on camera with second-accurate timestamps. Harassment reports filed within minutes on a forensic analysis posted to my own page. South Korea, Brazil, Netherlands, and Canada showing up on content that has no organic pathway to international audiences.

They built a permanent surveillance system to monitor my every post. When I published an article documenting the attack, the surveillance system immediately attacked the article about surveillance. Every action they take proves the article. Every inaction lets it stand.

This isn't organic disagreement. This is infrastructure. Follower sensors. Automated scrapers. Geographic proxy routing. Coordinated reporting. Commercially acquired accounts. And it's all pointed at one person who showed that a cipher could be solved with pen and paper.

The math doesn't care about their downvotes. 1.58M views and counting.

Evidence archive: Timestamped screenshots with time.is verification, RedditMetis karma curve data, Post Insights geographic breakdowns, A/B test results, and complete hostile account profiles maintained at r/TheDecipherist