Skip to content
HackIndex logo

HackIndex

Account Deletion and Reactivation Detection

4 min read Jul 11, 2026

Overview

Account deletion detection determines whether a subject has deleted an account and when. Reactivation detection identifies when a deleted or dormant account returns, or when a subject creates a replacement identity after deletion. Both are relevant in investigations where subjects manage their digital footprint deliberately or where account activity patterns are part of the intelligence picture.

Detecting Deletion Through Status Transitions

The most reliable deletion signal is a URL that previously returned a valid profile page now returning a 404, 410, or redirect to a generic error page. Cross-reference current status against archived snapshots to confirm deletion rather than a temporary outage.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w "%{http_code}" https://twitter.com/$USERNAME 
404

Combine with a Wayback Machine CDX check to confirm the account existed before the 404:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://web.archive.org/cdx/search/cdx?url=twitter.com/$USERNAME&output=json&fl=timestamp,statuscode&limit=20" | jq '.[] | select(.[1] == "200" or .[1] == "404") | {timestamp: .[0], status: .[1]}' 
{
  "timestamp": "20220304110000",
  "status": "200"
}
{
  "timestamp": "20230811093000",
  "status": "404"
}

This narrows the deletion window to between the last 200 and first 404 snapshot. Cross-reference that window against other events in the investigation timeline.

Platform-Specific Deletion Signals

Different platforms handle deleted accounts differently and produce different observable signals:

  • Twitter and X — deleted accounts return a generic suspension or not found page. The username becomes available for re-registration after a period. A username that was previously confirmed as belonging to your subject but now shows a fresh account with no history indicates the original was deleted and the username was reclaimed.

  • Reddit — deleted accounts replace the username with [deleted] in post history. Comments and posts remain visible with the username stripped. The account page at reddit.com/u/username returns a 404.

  • LinkedIn — deleted profiles return a generic not found page. The profile URL slug may be reused by a different user after a period.

  • Instagram — deleted accounts return a generic page. The username becomes available for re-registration immediately in some cases.

  • GitHub — deleted accounts show a generic 404. Repositories that were public before deletion may still be forkable if they were forked by others before removal.

Monitoring for Reactivation

When a subject deletes an account that is relevant to an ongoing investigation, monitoring for reactivation or replacement account creation is useful. Set up periodic checks on the original profile URL and on username variations derived from the deleted handle.

A simple cron-based monitor for account reactivation:

#!/bin/bash
USERNAME="target_handle"
URL="https://twitter.com/$USERNAME"
STATUS=$(curl -s -o /dev/null -w "%{http_code}" $URL)

if [ "$STATUS" == "200" ]; then
  echo "$(date): Account $USERNAME is ACTIVE" >> monitor.log
else
  echo "$(date): Account $USERNAME returned $STATUS" >> monitor.log
fi

Schedule with cron to run at a suitable interval. For higher-frequency monitoring or multiple targets, wrap this in a loop over a target list and add alerting via email or webhook.

Identifying Replacement Accounts

Subjects who delete an account and create a replacement often reuse recognisable elements: similar username patterns, the same profile photo, the same bio text, or the same follower network. Search for these signals after a confirmed deletion:

  • Run the deleted username through variation generation and check new accounts on the same platform

  • Reverse image search the subject's known profile photos to find new accounts using the same image

  • Search for the subject's known bio text verbatim to find profiles that have copied it

  • Check whether former followers or connections have followed or connected with a new account in the period after deletion

Distinguishing Deletion from Suspension

Platform suspensions and voluntary deletions produce similar observable signals but have different implications. A suspended account indicates a platform policy violation or abuse report, which may be relevant context. Some platforms display a distinct suspension message rather than a generic 404, making the distinction clear. Where the response is ambiguous, check whether the username appears on known suspension tracking services or in platform transparency reports.

References