There has been a rise in the number of terrorist incidents in which social media use has been implicated in the planning and execution of the attack. Efforts to identify online risk signals of terrorist offending is challenging due to the existence of the specificity problem– that while many people express ideologically and hateful views, very few go on to commit terrorist acts. Here, we demonstrate that risk signals of terrorist offending can be identified in a sample of 119,473 online posts authored by 26 convicted right-wing extremists and 48 right-wing extremists who did not have convictions. Combining qualitative analysis with computational modelling, we show that it is not ideological or hateful content that indicates the risk of an offence, but rather content about violent action, operational planning, and logistics. Our findings have important implications for theories of mobilization and radicalization.