Mass youtube account generator

[UltraMysterious]

In order for you to beat Google you need to crack their BG response. Which is BotGuard. Botguard in and of itself is an amazing piece of software. Google literally created their own Javascript virtual machine for compiling and handling BG responses on the fly.

Say you try and create a Google account using your bot for typing/clicking and a little bit of scrolling. There might be 30 other things Google is looking at that you can't even imagine.

Screen Color, other Google cookies, other Google adsense cookies, random plugins, the list goes on and on.

The key thing people don't realize about taking on BG.response is actually quite simple. It's a matter of AI + Reverse engineering what inputs/data they are collecting to input into their BG.response code generator.

I used to automated Youtube Account generation back in 2014 and could do it all 100% non-pva. With typing/clicking as you are testing right now. You need to dig deeper and find a much more custom browser so you can edit/see what Google is sniffing around for. I'd say its 100% possible to automate creating accounts, just takes a whole new set of skills that not a lot of people have.

I to this day want to automate/fake cookies in a browser, I read in a thread about someone managing to break Recaptcha using their audio only captcha. They said in that thread that 5-6 days of normal browsing seemed to calm down Google's recaptcha difficulty in recaptcha. There's a hint of what Google might be looking into when it comes to creating accounts.

Say for example it might be Google is looking into cookies. Most account creators now a days, clear their cookies before making an account. What if we were to generate/simulate dozens of cookies from thousands of different sites. Mix that with a concoction of everything else. Might be what people need to make accounts.

The system I have at the moment using a .NET browser and different proxies is working perfectly. I don’t even know if my random user agents are necessary, but I implemented that anyway.

 

[ZennoScripts]

You see, I have a very rare advantage and that’s that I work for a telephone company so I have access to millions of numbers. I’ve automated a system which assigns myself a block of numbers, routes them to a single telephone with a pager on and call recording. This then gets sent to my email address. I then tried to create voice recognition software but it doesn’t understand certain numbers. If I could get that working reliably, I would have a system which completes the account creation form, enters a number, receives the call and turns the recording into the code, enters it, submits and stores the login credentials. That voice recognition issue is the only thing in the way of a completely automated system

That's awesome but you are missing a key detail most people don't realize.

Each YouTube account created is given a Quality Score. Say from 1 - 10.

10 - you can create the account without phone verification, upload videos, and post comments with link without ghosting for the first 10 times.
5 - you can create the account without phone verification, can't upload a video without some type of ghosting, and you also can't get a single comment with a link to not be ghosted.
1 - you can create the account with phone verification, can't upload a video without being banned instantly, and you also can't get any type of comment with/without a link to go through without it being ghosted.

You need to bypass phone verification entirely for your account quality to be good enough for spamming on YouTube.

This isn't some child's play YouTube is at, it's the real deal.

Either bypass phone verification or don't bother spamming YouTube.

 

[UltraMysterious]

That's awesome but you are missing a key detail most people don't realize.

Each YouTube account created is given a Quality Score. Say from 1 - 10.

10 - you can create the account without phone verification, upload videos, and post comments with link without ghosting for the first 10 times.
5 - you can create the account without phone verification, can't upload a video without some type of ghosting, and you also can't get a single comment with a link to not be ghosted.
1 - you can create the account with phone verification, can't upload a video without being banned instantly, and you also can't get any type of comment with/without a link to go through without it being ghosted.

You need to bypass phone verification entirely for your account quality to be good enough for spamming on YouTube.

This isn't some child's play YouTube is at, it's the real deal.

Either bypass phone verification or don't bother spamming YouTube.

I don’t quite understand. Is each account assigned a random quality?

Note - I’m creating google accounts

 

[ZennoScripts]

I don’t quite understand. Is each account assigned a random quality?

Note - I’m creating google accounts

It's not a random quality/score, it's a very real score that Youtube/Google uses for all of their accounts.

It's their way of determining who is a spammer and who is a regular user.

 

[bigot]

I somewhat agree with what Brian said, just not how he said it.

You don't seem to be very experienced in web automation, so Google is a bad place to start. Maybe start on something smaller and easier to figure out how to get around some of the smaller hurdles, attempt a Google thing once you've overcome some of the easier barriers.

Don't change POST to GET. This will ruin pretty much everything since servers see POST and GET variables as totally different. Instead, use Developer Tools (or find a browser plugin for sniffing). Any "obfuscation" your browser does is intended, and the data is sent like that to the server.

Here's a path you can follow to learn:

1. Find a crap blog that lets you post a response without making an account or verifying email. Practice automating posting to it.
2. Find something slightly more complex. For example something with a crappy text captcha like "1+3", but the numbers always change. Practice scraping those 2 numbers and sending the sum in your automatic post.
3. Even more complex; a bot that logs into a common platform, for example vBulletin.... (I'm not a bot I swear)
4. Keep increasing complexity until you hit Google level. You will know when all of your optimism is gone and you don't want to do it anymore.

 

[UltraMysterious]

It's not a random quality/score, it's a very real score that Youtube/Google uses for all of their accounts.

It's their way of determining who is a spammer and who is a regular user.

Som

It's not a random quality/score, it's a very real score that Youtube/Google uses for all of their accounts.

It's their way of determining who is a spammer and who is a regular user.

What I don't understand is how google can create a score for your account when we're talking about making accounts.

If the score affects whether you can create accounts requiring phone verification or not, what is that score on? Some sort of parent account?

 

[UltraMysterious]

I somewhat agree with what Brian said, just not how he said it.

You don't seem to be very experienced in web automation, so Google is a bad place to start. Maybe start on something smaller and easier to figure out how to get around some of the smaller hurdles, attempt a Google thing once you've overcome some of the easier barriers.

Don't change POST to GET. This will ruin pretty much everything since servers see POST and GET variables as totally different. Instead, use Developer Tools (or find a browser plugin for sniffing). Any "obfuscation" your browser does is intended, and the data is sent like that to the server.

Here's a path you can follow to learn:

1. Find a crap blog that lets you post a response without making an account or verifying email. Practice automating posting to it.
2. Find something slightly more complex. For example something with a crappy text captcha like "1+3", but the numbers always change. Practice scraping those 2 numbers and sending the sum in your automatic post.
3. Even more complex; a bot that logs into a common platform, for example vBulletin.... (I'm not a bot I swear)
4. Keep increasing complexity until you hit Google level. You will know when all of your optimism is gone and you don't want to do it anymore.

I'm not attempting to send GET data instead of POST data. I simply changed the form method to see which data was sent to which URL. That way, I could send those same parameters as a POST request. If I submitted the form via post, I would have no idea in which format the data is sent.

Assuming you're talking about mimicking mouse movements and keypresses as opposed to sending raw requests;

I will work on 1.
Creating google accounts doesn't involve captcha, so I won't need to focus on that.
I've already created bots to log into accounts in the past.
4: N/A. I never give up.

 

[frzs90]

Are you planning to sell this as a software, or use internally, and sell/use the accounts?

If the latter, I would just use web browser automation. You don't have to worry about request parameters any more, and any hidden security check you may miss. Buy a ton of high quality, google safe proxy, fire up some servers, run the bot on as much thread as possible, warm them up by IP by searching random words on google and visiting random pages for a short while, then go for the registration, and hope the best. And use as much randomization as possible.

By the way I like your attitude.

 

[UltraMysterious]

Are you planning to sell this as a software, or use internally, and sell/use the accounts?

If the latter, I would just use web browser automation. You don't have to worry about request parameters any more, and any hidden security check you may miss. Buy a ton of high quality, google safe proxy, fire up some servers, run the bot on as much thread as possible, warm them up by IP by searching random words on google and visiting random pages for a short while, then go for the registration, and hope the best. And use as much randomization as possible.

By the way I like your attitude.

Thanks, I’m thinking web browser automation is the best bet with a fake user agent and screen size. Every account I create will use the same screen size and user agent that was used when the account was created.

I’m looking to use the accounts to provide paid views and likes on YouTube.

Searching for random terms is a brilliant idea. I didn’t understand how far google’s tracking branched out, so I’ll be as careful as possible using lots of randomisation and realistic usernames.

I also believe the randomly generated passwords were seen as suspicious as they were very random to make sure the account creation form would accept the password first time. I’ll use a mixture of real words, a few numbers and symbols instead of ridiculously long passwords which no human could realistically use on a regular basis.

I think making the bots watch random videos, comment generic things and give a like or dislike here and there would definitely contribute towards how legitimate google sees them as.

My only concern is I’ve been using a reliable api which gives me a random proxy, no connection problems so far. Is there anything they might be doing which gets in their way of keeping bots under the radar?

Any more tips would be greatly appreciated. I know I’m asking for help but I hope I’m also demonstrating I have sufficient knowledge and I’m not looking to be spoon fed c:

 

[bigot]

I'm not attempting to send GET data instead of POST data. I simply changed the form method to see which data was sent to which URL. That way, I could send those same parameters as a POST request. If I submitted the form via post, I would have no idea in which format the data is sent.

Understood. Still you should be sniffing the POST request without changing it to GET.

Assuming you're talking about mimicking mouse movements and keypresses as opposed to sending raw requests;

Don't waste your time mimicking mouse movements (or anything else speculated to be a security feature) unless you're positive they're using that data. There are lots of other footprints you should pay attention to; browser width/height, browser plugins, etc. etc. - Again don't give yourself a headache faking all this crap until you're sure they use the data.

I will work on 1.
Creating google accounts doesn't involve captcha, so I won't need to focus on that.
I've already created bots to log into accounts in the past.
4: N/A. I never give up.

They will throw captcha at you once you set off enough red flags. Monitor your bot until you're sure it's stable. Build in fail-safes; if it detects captcha, it should stop and wait for you to figure out a solution (since you're not worrying about captcha to start).
Having experience with log-in bots is great. Just remember to clear your cookies between sessions. If it's a threaded bot, ensure the cookies remain separate and each thread uses a different proxy.

By the way I like your attitude.

Me too. Lol.

 

[UltraMysterious]

Understood. Still you should be sniffing the POST request without changing it to GET.


Don't waste your time mimicking mouse movements (or anything else speculated to be a security feature) unless you're positive they're using that data. There are lots of other footprints you should pay attention to; browser width/height, browser plugins, etc. etc. - Again don't give yourself a headache faking all this crap until you're sure they use the data.



They will throw captcha at you once you set off enough red flags. Monitor your bot until you're sure it's stable. Build in fail-safes; if it detects captcha, it should stop and wait for you to figure out a solution (since you're not worrying about captcha to start).
Having experience with log-in bots is great. Just remember to clear your cookies between sessions. If it's a threaded bot, ensure the cookies remain separate and each thread uses a different proxy.


Me too. Lol.

I did think about each thread using a different proxy but I don’t believe you can do that with the web browser control as it uses IE and changes to IE’s proxy are global. If I use a WebClient, useful for post/get requests, I can specify a proxy for that specific web client. However this means if google monitors mouse movements, they won’t get any of that information if I only send requests and they would almost certainly flag that as suspicious.

I’ve made sure WebRTC isn’t leaking my local ip and that java plugins and flash are disabled for IE, which then affects Webbrowsers.

Whilst creating google accounts I’ve never faced a captcha. I don’t know where people have been experiencing them

 

[frzs90]

I see you are talking about C# built in tools.
I was talking about using and controlling headless browsers, as they are much faster, more suitable for this kind of project, and require less resources.

Search for headless browsers, find the most suitable, or the one you like the most. There are a couple of open source projects to check out.
If you never heard of them, I'm talking about something like this:
https://chromeless.netlify.com/

When you try to trick someone, you have to think like them to avoid getting caught. If you decide to go with the automated (headless) browser method, read a lot about how to detect them. And how to fake those suspicious things to look real. There are a lot of article about detecting them.

(However please note that I never used a headless browser before, just know a few things about them)

 

[itz_styx]

yes google services are a bit harder to automate, but of course you can do it with pure GET/POST requests which is more work, but also more reliable as you have full control.
people always suggest using headless browsers and then wonder why they get detected. they have obvious footprints that you can avoid by creating the http packets yourself.
so back to your OP: you need to handle the cookies too obviously, did you do that? another thing is the timestamps and other dynamic form values.
you may have to execute some js functions first to generate these values, which can be done in different ways and without headless browsers.
also as previously suggested, better use a sniffer to see the packets, or at least install a browser plugin like live-headers that makes life a lot easier

 

[UltraMysterious]

yes google services are a bit harder to automate, but of course you can do it with pure GET/POST requests which is more work, but also more reliable as you have full control.
people always suggest using headless browsers and then wonder why they get detected. they have obvious footprints that you can avoid by creating the http packets yourself.
so back to your OP: you need to handle the cookies too obviously, did you do that? another thing is the timestamps and other dynamic form values.
you may have to execute some js functions first to generate these values, which can be done in different ways and without headless browsers.
also as previously suggested, better use a sniffer to see the packets, or at least install a browser plugin like live-headers that makes life a lot easier

Are you sure it’s possible with JS alone? If there’s php involved I’m screwed because I can’t do anything about it

I noticed a cookie called GAPS whose value changed every time I edited a field or made a form element lose focus. No idea how to generate that

 

[bigot]

but of course you can do it with pure GET/POST requests which is more work, but also more reliable as you have full control.

I agree 100%. The extra work is well worth it; you have easy control over all the headers that are sent, reducing the likelihood of getting caught.

I did think about each thread using a different proxy but I don’t believe you can do that with the web browser control as it uses IE and changes to IE’s proxy are global

This is another reason to do it without webbrowser control.

However, if you must use web browsers, there is a sort of workaround...
- Add a dummy header like "ThreadNum: x"
- Create a local proxy that listens to port 1234
- Set your global proxy to 127.0.0.1:1234
- Local proxy reads (and removes) "ThreadNum: x" and redirects the request to the appropriate external proxy based on the thread number.

Are you sure it’s possible with JS alone? If there’s php involved I’m screwed because I can’t do anything about it

I noticed a cookie called GAPS whose value changed every time I edited a field or made a form element lose focus. No idea how to generate that

JS is client-side. Anything happening in your browser must be JS. PHP is server-side. itz_styx is right about having to execute JS.

If GAPS is a cookie, just keep an eye out for the "Set-Cookie" response header. If it's not set there (or if it's set there to a different value than what it sends in the next request), then it's being updated by JS.

 

[itz_styx]

Are you sure it’s possible with JS alone? If there’s php involved I’m screwed because I can’t do anything about it

I noticed a cookie called GAPS whose value changed every time I edited a field or made a form element lose focus. No idea how to generate that

well what language are you using for your account creator? in theory you could do it in pure js, but its clumsy and not as fast (can't be multithreaded) so you could just as well automated mouse movements and send keys to a open browser window

 

[UltraMysterious]

I agree 100%. The extra work is well worth it; you have easy control over all the headers that are sent, reducing the likelihood of getting caught.



This is another reason to do it without webbrowser control.

However, if you must use web browsers, there is a sort of workaround...
- Add a dummy header like "ThreadNum: x"
- Create a local proxy that listens to port 1234
- Set your global proxy to 127.0.0.1:1234
- Local proxy reads (and removes) "ThreadNum: x" and redirects the request to the appropriate external proxy based on the thread number.



JS is client-side. Anything happening in your browser must be JS. PHP is server-side. itz_styx is right about having to execute JS.

If GAPS is a cookie, just keep an eye out for the "Set-Cookie" response header. If it's not set there (or if it's set there to a different value than what it sends in the next request), then it's being updated by JS.

And what if the fields are sent to the server, encrypted, stored and sent back? I would have to figure out how to perform that encryption. If I give the same one, it’ll see it’s already been used. Or the generated one won’t match the one I produce even though the inputs are the same due to randomisation

 

[UltraMysterious]

well what language are you using for your account creator? in theory you could do it in pure js, but its clumsy and not as fast (can't be multithreaded) so you could just as well automated mouse movements and send keys to a open browser window

I’m using VB.NET which supports multithreading, I meant whether there’s php code observing things or if I can just invoke js methods and it’ll work fine

 

[Cognitive]

Very interesting ideas in this thread!

I would just add that the IP/ Proxy is crucial for a successful google account creation. I have a script that is able to create google accounts easily (no mouse/ keyboard emulation) if the proxy is high quality (fresh, clean dedicated proxy) or if I use my ISP's dynamic IP's. But if I load a shared proxy, phone verification always occurs.
I mention that this script uses a modified firefox engine and I also rotate some user agents; no GET/ POST requests at all, though.

Canvas and Client Rects emulations don't seem to improve the success rate.

Hint: make sure the geolocation and the timezone of your browser/ machine matches the IP geo and timezone

 

[UltraMysterious]

Very interesting ideas in this thread!

I would just add that the IP/ Proxy is crucial for a successful google account creation. I have a script that is able to create google accounts easily (no mouse/ keyboard emulation) if the proxy is high quality (fresh, clean dedicated proxy) or if I use my ISP's dynamic IP's. But if I load a shared proxy, phone verification always occurs.
I mention that this script uses a modified firefox engine and I also rotate some user agents; no GET/ POST requests at all, though.

Canvas and Client Rects emulations don't seem to improve the success rate.

Hint: make sure the geolocation and the timezone of your browser/ machine matches the IP geo and timezone

Ooh, that’s crucial, didn’t think about that. I don’t believe websites are able to access my location but timezone perhaps.

So I’m guessing you must be directly setting the textboxes’ values. I don’t mind phone verification as I have so many numbers at my disposal, but it’s more time wasted and sometimes calls don’t come through.

I really don’t want to have to buy proxies as each one can only make very few accounts, I’ve seen. What would be convenient is if there was a way to force an ip change from your isp without changing macs and raising suspicion, for example.

If you wouldn’t mind sharing part of your script, that’d be really useful to understand the approach, or at least pseudo code would give a good idea