Sockpuppet ring.
A handful of accounts that only ever talk to each other to make a thread look popular.
What it looks like
Sockpuppet rings are the engagement-manufacturing layer underneath most of the other playbooks. One operator runs N accounts. They all post in a planned sequence — OP asks the question, sockpuppet 1 chimes in with the lead, sockpuppet 2 endorses the lead, sockpuppet 3 asks for the DM. A casual reader sees a busy, organic thread.
The ring is detectable structurally: real Reddit conversations are tree-shaped (many people branch off the original post). Sockpuppet rings are closed loops — the same small set of accounts only reply to each other, never to outside skeptics, and never on any other topic.
How the scanner catches it
- The scanner builds the in-thread reply graph and surfaces cliques where the same N accounts only respond to each other. A 4-account ring inside a 30-comment thread is the canonical pattern.
- Stylometric matching runs across the suspicious accounts — Claude reads pairs and flags when different usernames write with the same idiosyncratic punctuation, filler ("ya," "tbh,"), and clause habits.
- Account-age clustering: when 5 of 6 sockpuppets registered within the same 2-week window months before the thread, that's surfaced as a coordinated-creation flag.
Surface markers
Exact phrases and patterns the scanner reads as evidence. These aren’t sufficient on their own — a real-person comment can sound this way too — but they push the verdict toward the pattern when they cluster with the structural flags above.
Where it shows up
Paste the Reddit post URL into the scanner. If this is the playbook, the report will name it explicitly and surface the evidence above.
Open the scanner