Sort-of accidentally (and sort-of obviously) I noticed that 'normal people' on reddit had a predictable distribution of activity over the day. Normal people sleep, and it shows up in their post activity (on snoopsnoo, for example).

Here's one example of a normal user. They have a sharp but obvious dip in the early hours, corresponding to a normal human in the eastern US who stays up too late. A heatmap of their last 60 days of activity shows a stable band of zero activity, suggesting they have some reason to get up at the same time consistently.

Here's another example of a normal user, this time with a wider dip in activity, implying they sleep more or take longer in the morning. And their activity heatmap again shows a very strong 'sleep band', along with a sharp reddit break for a few days. Normal people do this too, I think.

This is pretty cool already because we can use this to infer where the user lives from the hours they sleep. This is assuming the distributions always follow a similar shape.

Can we also use the distribution to infer whether they're a real user? Maybe.

Take this user for example, and their activity heatmap. This is far outside of what I'd consider a 'normal person'. They have a slight dip in the hours you'd expect a person to be sleeping in EST or AST, but it's very slight. Their heatmap shows a wildly unstable band of inactivity which sometimes disappears completely. Is this person a meth addict? It seems safe to assume this person has no job and has a completely transient sleep phase. It could be two people on one account, or an account shared by a pool.

Here's another user I believe is a 'normal person', but nontheless has a strange distribution. They seem most active when EST/AST people are asleep. Their heatmap shows an extremely focused band of activity, followed by relative inactivity, capped by a 1-hour band of extremely consistent, on-the-hour activity. This user is probably a real person on a very rigid schedule -- school, military, labor, etc.

Anyway, I find this really interesting, and wondered if it'd be useful for understanding suspicious users. It depends on a couple of things, though: a decent amount of account history, and some pretty big assumptions. Still, I think suspicious activity stands out well enough, and will lack any other rational explanation.