I spent a chunk of time trying to build a Reddit account farm — meant to seed distribution for projects I’m about to ship. Spend: $50 on proxies, a handful of antidetect browser profile slots, 5sim SMS numbers, plus a full week of engineering and sleep debt. Outcome: accounts can be created at scale, but outbound reach is zero. Here’s why.

Reddit’s anti-bot stack is three layers. Each layer catches a different thing. I walked through all three before the full picture came together.

Layer A: register-time fingerprint score. The register page runs score-based reCAPTCHA Enterprise — three iframes, no visible challenge, scoring directly on IP + browser fingerprint. Low score = silent reject. Click Continue, nothing happens. No error, no toast, page doesn’t move. Camoufox / Patchright / vanilla Playwright all die at this layer because their fingerprint patterns are outdated against 2026’s anti-bot revision (Camoufox’s lead had a medical emergency earlier this year and updates stalled). Retrying makes it worse — each failed attempt pushes the score lower. One profile per attempt, fail once and the profile is burned. Swap to a fresh one.

How to skirt Layer A: pure HTTP. curl + cookie jar POSTs straight to /api/register. No JS engine, no fingerprint score to fail. That path worked. 1,639 accounts came out of it.

Layer B: post-register retro-audit. Days to weeks after creation, Reddit silently audits accounts. Anomalous fingerprint patterns get the account locked with an “unusual activity” banner. This one is passive. Registration looks fine; two-to-three weeks later, your pool gets harvested. More than half of the 1,639 fell here.

Layer C: shadowban honeypot — the deadliest layer. Account isn’t locked. Login works. Posting a comment works (HTTP 200, permalink returned). Upvotes work (likes=True). Refresh your own view, everything looks normal. View the same comment from an anon session — “The comment does not exist.” Reddit filters your comments / votes / submissions server-side. Your own view always shows them (UI illusion), no one else does. The account is fully functional and has zero outbound reach. The entire 1,639-pool sat here. The design intent is unambiguous: make you think the farm is running so you keep burning effort.

Stacked on top of all three: the proxy side has its own wall. Bulk residential vendors (IPRoyal / DataImpulse / Webshare / Proxy-Seller / ProxyEmpire) have their CIDRs on Reddit’s edge block list. TCP CONNECT gets a hard RST — curl: (56) Recv failure: Connection reset by peer. The handshake never completes. The only exits that clear Reddit’s edge are AnyIP’s mobile / ISP-static pools — but that only solves “can I connect.” Layer C is untouched.

Reddit’s anti-bot is structural. Layer A catches tools that have a fingerprint. Layer B catches whatever Layer A missed via batch behavior. Layer C is the safety net — fully functional accounts, zero reach. The OSS stack (Camoufox / Patchright / curl_register) is outdated against 2026’s revision. Commercial antidetect (AdsPower / Multilogin) may clear Layer A, but Layer B and C are server-side. Paid tools don’t save you there.

Reddit didn’t work as a distribution path for me. The farm didn’t ship.

But pulling the three layers apart sharpened my understanding of anti-spam system design. Layer C is especially elegant — don’t ban, don’t rate-limit, let the spammer burn their own resources and keep refreshing their own view thinking it works. Any product handling user-generated content should study this pattern.