About Hugin

Where it started

Hugin began with one question: is this Reddit post a scam? The honest answer is usually sitting in plain sight — the account is two days old, the replies all landed in the same minute, every comment funnels to the same off-platform link. But nobody has time to chase that down by hand. So the first version did exactly that: paste a Reddit thread, get back the account ages, the timing, the reply graph, and the outbound links, organized into one readable verdict.

How it grew

The same question — can I trust this? — applies to the whole public web, not just Reddit. So Hugin grew into a general evidence engine: paste any public URL and it fetches the page and cross-references what it finds across independent records — domain registration age, TLS-certificate history, web-archive history, DNS and email setup, hosting network, and public threat-intel feeds (CISA KEV, abuse.ch, and, where configured, Google Safe Browsing and urlscan.io).

The point of all that is corroboration. Any single signal can be gamed; a verdict you can trust rests on several independent sources agreeing. Every report carries an evidence-confidence score for exactly that reason — how many separate checks point the same way.

What stays true

Public material only.Hugin reads what’s already published to the world. It never asks you for logins or private account access, and never authenticates as anyone.

Signals, not accusations. A report shows patterns, timing, links, and source context. It does not identify a real person or decide misconduct — and every report is disputable at a stable URL.

Reddit deep scans — the bookmarklet (no install)

Reddit threads get the deepest treatment: the full commenter network, account ages, and co-appearance patterns, not just the page. There’s a catch — Reddit started blocking data-center IPs from fetching post JSON in 2024, and every major cloud is on the list, so Hugin’s servers can’t reach Reddit directly. The bookmarklet runs in your browser on the Reddit page itself, fetches the post + every commenter from your residential connection, and POSTs the result to Hugin. Reddit sees a normal user reading a post. Hugin gets the JSON.

Drag this button up to your bookmarks bar:

🐦‍⬛ Scan with HuginDrag the button; clicking it on this page will not start a scan.

Then: open any Reddit post you want scanned → click the “🐦‍⬛ Scan with Hugin” bookmark in your bar → a small gold panel appears in the top-right (“Pulling post + commenters…”) → about 10–30 seconds later the report opens in a new tab.

On your phone? Set up the bookmarklet on iOS Safari or Android Chrome →

Doesn’t work? Some desktop browsers block dragging javascript: links. Make a bookmark by hand instead: right-click your bookmarks bar → Add page→ name it “Scan with Hugin” → for the URL, paste this whole line:

javascript:void((function(){var s=document.createElement('script');s.src='https://hugin.studio/companion.js?t='+Date.now();document.body.appendChild(s);})());

Power-user alternative — browser extension

Same idea as the bookmarklet, but installed as a proper browser extension. Polished popup UI, can run on demand from any page, works without leaving the Reddit tab open. Requires sideloading (Chrome, Edge, and Brave do not accept unsigned extensions in their stores without review).

⬇ Download Hugin Companion (.zip, 5.7 KB)

Install steps (Chrome / Edge / Brave):

1. Download the zip above and extract it to any folder.
2. Open chrome://extensions/ in a new tab.
3. Toggle Developer mode on (top-right).
4. Click Load unpacked → pick the extracted folder.
5. Pin the Hugin icon to your toolbar.

Community flags

Each profile page (/u/<name>) has a “Flag account” button anyone can use. Flags are aggregated and de-duplicated per network — one flag per /24 — so a single bad actor can’t flood a target’s count. Reasons are canned to prevent arbitrary text from being weaponised.

Corrections

If you believe a report or flag mischaracterises an account or a site, email contact@hugin.studio. The underlying public data is what it is, but the playbook label and verdict text can be revised when we’ve misread the signal — every report lives at a stable URL so a correction points at the exact evidence in question.