Instagram Api Account creation fails

[Zapdron]

The past few weeks I was creating Instagram accounts via Api requests. The success rate was very high, close to 100% depending on the proxy. However since 2 days I'm not able to create a single account with this method anymore, all accounts get a challenge.
I simulate the Api requests of the Instagram iOS App version 146.
Does anybody have the same problem and knows a solution?

 

[Frenzied]

Unless you send the 50 logging requests that go before the create request that track user movement & hack one of the tokens that people pay up to $200k for, then be prepared to loose your API creator to updates. API creators are tricky.

 

[Zapdron]

I have reversed every request that goes before the create request. Until 2 days ago it was working perfectly fine.
What token are you talking about? Since Instagram v. 136 Instagram stopped signing requests, so signature key is not needed anymore and the enc_password I can create. There is no other token in any request.

 

[brasilianbusinessman]

I have reversed every request that goes before the create request. Until 2 days ago it was working perfectly fine.
What token are you talking about? Since Instagram v. 136 Instagram stopped signing requests, so signature key is not needed anymore and the enc_password I can create. There is no other token in any request.

Wanna try something?

 

[Zapdron]

Wanna try something?

Sure, what to try?

 

[brasilianbusinessman]

Sure, what to try?

I cant send private messages, was going to try to test it with a brazilian 4g ip, did you tried with other countries Ips?
If not, try to get some 4g rotative proxy trial and test it

 

[Zapdron]

I cant send private messages, was going to try to test it with a brazilian 4g ip, did you tried with other countries Ips?
If not, try to get some 4g rotative proxy trial and test it

The IP is not the issue. I created many test accounts with my ips on the real device I capture the requests from and all of them were successful. So there error is definitely somewhere in my code

 

[smmprime]

IG performed huge update yesterday.
Very lwss things work now
I think you wont be able to create accounts in near future

 

[brasilianbusinessman]

IG performed huge update yesterday.
Very lwss things work now
I think you wont be able to create accounts in near future

I am sure they did something new, I was using some old accounts that were recovered and they are again stuck into the captcha trap.

I call it a trap because you solve the captcha, put the number, get the code and then it tell you they will review on 24 hours.

But then it release again, when you try it show it like the captcha were never done.

Everytime you do this they put the number to a new database, the number can be used 2 times and it wont work anymore even after 48h-72 hours.

Also, you can ask to change the password and it will show when you put the new one "Oops, a n error occured" so I am sure they are doing this trap to lock more numbers, some days ago you just needed to put captcha+new phone and the old account were released.

 

[Zapdron]

Hmm shit. That doesn't sound good.

 

[surveycp]

yea, the same to me , im using 146 android vertion to creat account. all accounts get challenge by using email and less than 1% success rate by using phone number . Do you have any idear rightnow?

 

[Zapdron]

yea, the same to me , im using 146 android vertion to creat account. all accounts get challenge by using email and less than 1% success rate by using phone number . Do you have any idear rightnow?

The next thing I want to try is to block all logging clients event requests with burp on the real device. If account creation still works I can be sure that this is not the problem. If account creation fails, we should focus on those more.

 

[surveycp]

You post the logging clients event date when creat account?
In my experience, we just wait a month. everything will be fine ):

 

[Zapdron]

You post the logging clients event date when creat account?
In my experience, we just wait a month. everything will be fine ):

Yes this is the data I send with the first logging client event:

user_data = json.dumps({
        'phone_id':124024574287414,
        'channel':'ads',
        'time':time2,
        'app_ver':'146.0.0.21.122 (220223664)',
        'device_id':phone_id,
        'family_device_id':phone_id,
        'session_id':str(uuid.uuid4()),
        'log_type':'client_event',
        'data':[
            {
                'extra':{
                    'exp_name':'ig_ios_aymh_cloud_store_experiment_v1',
                    'radio_type':'not-detected-yet',
                    'waterfall_id':waterfall_id,
                    'start_time':time1,
                    'elapsed_time':time2-time1,
                    'app_device_id':phone_id,
                    'exp_group':'test',
                    'pk':'0',
                },
                'tags':'0',
                'module':'waterfall_log_in',
                'name':'initial_app_launch_experiment_exposure',
                'time':time.time(),
                'sampling_rate':'1'
            }
        ],
        'app_uid':'0',
        'seq':'0',
    })

I'm not 100% sure if I get the time values right. As time2 I use the timestamp at the moment of the first action and time1 should be the app startup time. However I'm unsure what the other time value should be. In my captured requests it's always almost the same as time2 but very slightly different.

Yeah, I guess you are right.

 

[surveycp]

i never noticed the logging clients event date, will check and test it. thanks

 

[Zapdron]

i never noticed the logging clients event date, will check and test it. thanks

I also never needed them, it always worked without them before.

 

[surveycp]

Did you tested it yet? seems their is 5 logging clients event date before creat and all of the post data are different

 

[surveycp]

Yes this is the data I send with the first logging client event:

user_data = json.dumps({
        'phone_id':124024574287414,
        'channel':'ads',
        'time':time2,
        'app_ver':'146.0.0.21.122 (220223664)',
        'device_id':phone_id,
        'family_device_id':phone_id,
        'session_id':str(uuid.uuid4()),
        'log_type':'client_event',
        'data':[
            {
                'extra':{
                    'exp_name':'ig_ios_aymh_cloud_store_experiment_v1',
                    'radio_type':'not-detected-yet',
                    'waterfall_id':waterfall_id,
                    'start_time':time1,
                    'elapsed_time':time2-time1,
                    'app_device_id':phone_id,
                    'exp_group':'test',
                    'pk':'0',
                },
                'tags':'0',
                'module':'waterfall_log_in',
                'name':'initial_app_launch_experiment_exposure',
                'time':time.time(),
                'sampling_rate':'1'
            }
        ],
        'app_uid':'0',
        'seq':'0',
    })

I'm not 100% sure if I get the time values right. As time2 I use the timestamp at the moment of the first action and time1 should be the app startup time. However I'm unsure what the other time value should be. In my captured requests it's always almost the same as time2 but very slightly different.

Yeah, I guess you are right.

may i have your telegram or skype? i think we can discuss more about it

 

[Zapdron]

Did you tested it yet? seems their is 5 logging clients event date before creat and all of the post data are different

may i have your telegram or skype? i think we can discuss more about it

No, didn't test it yet. Hmm maybe it's different on iOS but I usually only see 1-2 login client events before the create request.

I sent you a pm with my telegram

 

[DaPromo]

Yeah there is no 50 log requests before, nor any "special token" and specially not one that is worth 200k usd. Every bot you make always requires maintenance on big sites, even on the lesser efficient web versions as selectors frequently gets updated due to element changes.
I made an API creator both for Android and iPhone a couple months back but the principle should remain the same so if you need any help let me know over PM and we can discuss.
It's also true they removed the request signing recently.