[Journey] Cracking Instagram's ML Algorithm

I have been researching for the past week on Instagram Account creation. Instagram like every other big company out there uses Machine Learning to combat botting, spam accounts etc.


With the intention of getting my accounts to last for the long term (not just chug and burn). I have researched a lot of things which I will be mentioning the basics of what I have scraped (not getting too in depth as every method has its own twists).


There are two major ways of Creating an Instagram account -through the browser and through the App.

Both having different major unique identifiers which you need to Fake in order to obtain a Unique Profile (not going too in depth)

What I mean by this:


IP - Important

Fingerprints – Very important

MAC (Only through app) – Important if using emulators or real phone account creation


If you want to know how I tackled these problems follow this thread I will be posting updates.


Goal 1: Achieve 100 accounts this week

Goal 2: Transfer accounts to proxies without PV

Goal 3: Monetise


But ultimate goal is to run digits.


How will I be creating these accounts? Custom scripts and programs written by me.

What I have done this week so far:

First attempt- I wrote a python script to register accounts using selenium chrome as the browser. It randomised usernames, names, password, addresses etc. Unfortunately, only after programming it did I realise that there was issues with this. It is just a random python script which anyone can really program, which means it wasn't unique and it will be easy to pick up by the system.

Second attempt- I realised the best way to go about this is using an emulator. Using Nox as an example, I programmed yet another python script which would do the same as before only this time enter the information through the emulator.

There were problems with this method (just like bluestacks).

If you are creating programs using the APP, the app will retrieve all the device details such as for example:

Wifi MAC - Can be spoofed.
IMEI - I randomised
Make Model - Just look at the settings
Device ID - No problem
Phone number - Randomised real phone numbers
Google Account details - Yes, I had to create google accounts to make it look more legit (which wasn't hard) - I created them online and solved the ReCaptcha's using Google's own Speech to Text (ironic right)

This next bit of information is for people that run emulators to create accounts so pay attention this is valuable:

I'm sure OG programmers know this, but instragram like many other apps can tell if you're running an emulator by looking at your screen dimensions. So when you next Create an account or use an emulator make sure your screen dimensions are that of the REAL device.

After finishing this I realised I had to scrape it. Why? Well even though everything was good I ran into two problems.

A)I was going to use 4G proxies to create an account and as you may know on emulators the Internet they get is from "Wifi"...
B)Because there is no real black box testing for this, the script was using OCR as a method of registering the accounts which isn't very scaleable and the bugs are of a ton.

Third attempt: I found this package that android was offering which was UIAutomation, awesome, this means I can run this through a spare android phone that I have which solves the IP proxy issues and the OCR.

Got halfway into doing this when I realised that the best way of creating accounts won't be via the app, because now that i'm using a real phone I can't just 'reset' them as easy as I can just reset emulators.

I knuckled down, researched some more and I have come up with an even better method.

Will be using this for the time being.

Mobile phones also have device fingerprints， you need some thing like IGrimace.

wkop2013 said:

Mobile phones also have device fingerprints， you need some thing like IGrimace.

Click to expand...

IGrimace, I have never seen this before thank you I will be taking a look at this

I found it was alot harder faking or really establishing a fingerprint for a profile via the phone.

Thanks for your input

I'm not 100% positive, but I think at least one of the two below can do mobile fingerprints. I could be wrong though.
- Search google for sphere browser
- Search google for multilogin browser

Read this:

https://www.blackhatworld.com/seo/must-read-top-4-instagram-threads-of-2018.1081669/

Hope the info helps.
Cheers!

Wyzgy239 said:

I'm not 100% positive, but I think at least one of the two below can do mobile fingerprints. I could be wrong though.
- Search google for sphere browser
- Search google for multilogin browser


Hope the info helps.
Cheers!

Click to expand...

Thank you for the information I will be taking a look at this.

The problem with multi login is that when they set their fingerprints they only use one GPU version - correct me if I’m wrong (I have tested this myself)
Also in terms of scaling it is expensive unfortunately but they do have the best GUI in terms of how easy it is to save accounts etc.

Currently I’m using something that does the samething but it’s better since I can interact with it easier using python which is the language I’m going to be using for this project.

I haven’t heard of sphere browser but I will look to see if it’s good or if I can find information that will help me.


Mobile fingerprints can’t be done on multi use either. When I meant mobile fingerprints I meant when running an emulator or on an actual phone device (it would be harder to really clamp down on it there for now)

Digital Finger said:

Thank you for the information I will be taking a look at this.

The problem with multi login is that when they set their fingerprints they only use one GPU version - correct me if I’m wrong (I have tested this myself)
Also in terms of scaling it is expensive unfortunately but they do have the best GUI in terms of how easy it is to save accounts etc.

Currently I’m using something that does the samething but it’s better since I can interact with it easier using python which is the language I’m going to be using for this project.

I haven’t heard of sphere browser but I will look to see if it’s good or if I can find information that will help me.


Mobile fingerprints can’t be done on multi use either. When I meant mobile fingerprints I meant when running an emulator or on an actual phone device (it would be harder to really clamp down on it there for now)

Click to expand...

What do you mean by GPU version? Canvas noise?

Arghs said:

What do you mean by GPU version? Canvas noise?

Click to expand...

I mean your GPU for example (nVidia xxxx or amd Navi xxx) or in WebGLs terms - unmasked renderer.

I can’t give you the exact one they simulate right now but I have tested it with 10 profiles they all simulated the same GPU.

Digital Finger said:

I mean your GPU for example (nVidia xxxx or amd Navi xxx) or in WebGLs terms - unmasked renderer.

I can’t give you the exact one they simulate right now but I have tested it with 10 profiles they all simulated the same GPU.

Click to expand...

Did you check what API calls instagram is making and if they actually check for all values that could be fingerprinted?

Arghs said:

Did you check what API calls instagram is making and if they actually check for all values that could be fingerprinted?

Click to expand...

No, I didn’t check as of yet. As currently I am not using android to create accounts once I do I will be looking to check what they pull from the device.

I pulled out from using emulators or phone since I’m trying something I thought might be even better.

EDIT: just realised you did not mean on mobile. Haven’t checked what Instagram is pulling, but I need to fake every single one since Instagram uses Facebooks prints and other websites to print a single user. It’s better to fake everything than to miss one single thing out and getting caught up in the long run. If this is what you mean?

UPDATE: 13/02/19

So far I have 7 Instagram accounts.

- 3 have no been email verified.
- 1 has a Facebook account
- 3 are normal accounts (verified)

All running using a mobile proxy.

I have not and I will not use any automation bots (such as Jarvee for example) since that will be changing any kind of fingerprints I have saved for each account.
Each account has it's own unique fingerprints.

Once the accounts reach maturity I will begin by merging the proxy IP I want the accounts to be by running them through the same fingerprints but with a different IP.

The creation I have not automated yet, I want to test this strategy then start automating.

Looking into it a bit more, I am thinking of maybe using a very common phone (Samsung S9) to emulate the creation of the accounts, not through the app but through the Browser.

That way they see the fingerprints as very common - there is no pattern.

Here is the code I whipped up fast to create random users : pastebin.com/NnRRSbx0

For proxys I have found a provider that claims to have tapped into Verizon's routers and thus able to make any router a proxy by porting into them.

Not sure about the claims the provider is making are legit they are rather expensive. We will see.

Digital Finger said:

UPDATE: 13/02/19

So far I have 7 Instagram accounts.

- 3 have no been email verified.
- 1 has a Facebook account
- 3 are normal accounts (verified)

All running using a mobile proxy.

I have not and I will not use any automation bots (such as Jarvee for example) since that will be changing any kind of fingerprints I have saved for each account.
Each account has it's own unique fingerprints.

Once the accounts reach maturity I will begin by merging the proxy IP I want the accounts to be by running them through the same fingerprints but with a different IP.

The creation I have not automated yet, I want to test this strategy then start automating.

Looking into it a bit more, I am thinking of maybe using a very common phone (Samsung S9) to emulate the creation of the accounts, not through the app but through the Browser.

That way they see the fingerprints as very common - there is no pattern.

Here is the code I whipped up fast to create random users : pastebin.com/NnRRSbx0

For proxy's I have found a provider that claims to have tapped into Verizon's routers and thus able to make any router a proxy by porting into them.

Not sure about the claims the provider is making are legit they are rather expensive. We will see.

Click to expand...

Thats how every residential proxy provider gets their "millions of ips". They exploit vulnerabilities within routers and inject their payload which connects back to their servers. Thats also why you can only connect to the proxies using a "backconnect" servers.

Arghs said:

EDIT: just realised you did not mean on mobile. Haven’t checked what Instagram is pulling, but I need to fake every single one since Instagram uses Facebooks prints and other websites to print a single user. It’s better to fake everything than to miss one single thing out and getting caught up in the long run.
I actually meant browsers, I'm working on the same thing as you are at the moment, and it works quite well so far



Thats how every residential proxy provider gets their "millions of ips". They exploit vulnerabilities within routers and inject their payload which connects back to their servers. Thats also why you can only connect to the proxies using a "backconnect" servers.

Click to expand...

I always thought they were just bullshitting on the amount of "residential" ip's they could get.

The problem is this company is charging $27 for each backconnect proxy port and these change IP's every 5 - 15 minutes. Which ins't exactly what I want.

For a static address they want $65 a month.

Trying to either find another company or get some deal fixed with this one.

I will keep the thread updated. Thanks for your input.

Digital Finger said:

I always thought they were just bullshitting on the amount of "residential" ip's they could get.

The problem is this company is charging $27 for each backconnect proxy port and these change IP's every 5 - 15 minutes. Which ins't exactly what I want.

For a static address they want $65 a month.

Trying to either find another company or get some deal fixed with this one.

I will keep the thread updated. Thanks for your input.

Click to expand...

Yes its harder to find static IP's because they can't stop users from turning off/changing or restarting their routers. I'd suggest you to setup a VPS through a host that offers residential like IP's.

Following your journey! I've read a lot of exciting things!

Keep us updated!

UPDATE 14/02/2019 -

I still have the same amount of accounts - not worked on this.
I have just ordered a Mini PCI-E to USB Adapter and a 4G WWAN Card separate - Ordered one just for now, i'm gonna run it. Then see if I can configure for two.

So far NONE of the accounts have been PV'd or Banned.

(Even the Facebook account it still running).

I'm going to leave these for one more day. If they all look healthy I will start mass account creating.

[UPDATE] - 15/02/2019 - Success

TOTAL ACCOUNTS (Testing strategy so far):
7 - Manual Creation

4 - Email verified [
3 - Not verified by any means (no email or phone)

Results:

All accounts working as expected - No shadow bans, No phone verification.

Conclusion:

This means this strategy that I have used is successful in creating accounts without triggering Instagram account suspensions or verification.

Now all I need to do, is successfully store fingerprints for each account that I create and program a mass creator using my strategy (shouldn't take me too long) - Tomorrow's updates I should have everything done.

Last comments:

Now what i'm hoping for, which is what I don't know yet is when I get my LTE module to get a new dynamic IP can I just use CMD Release and Renew I wonder? That would help automate my scripts.

Otherwise having to eject the USB to get a new ip might be a hassle unless I can tap into the Module. We will see.

Great thread.
So, you create accounts using mobile phone and browser, not IG app?
What data do you clean after account creation? Do you use any apps for cleaning data?

insomnijak said:

Great thread.
So, you create accounts using mobile phone and browser, not IG app?
What data do you clean after account creation? Do you use any apps for cleaning data?

Click to expand...

That's correct my current strategy does not use the IG app.

I do not clean my data I keep it

Digital Finger said:

That's correct my current strategy does not use the IG app.

I do not clean my data I keep it

Click to expand...

You just change 4G IP after every account creation?

insomnijak said:

You just change 4G IP after every account creation?

Click to expand...

I do change IP every account creation that's right.

But the process is not just that obviously. That would be too simple for my liking.