[Journey] Cracking Instagram's ML Algorithm

Question - what are you using to control the android phone? Tasker? Is there some sort of API so that you can remote control taps/keyboard on an Android phone much like selenium can do for browsers?
google ADB which stands for Android Debug Bridge. Can control just about all aspects of your phone without needing to root it. There are wrappers out there to use with python and other languages but they all basically tap into ADB
 
If you are doing it manually, I would just suggest the following (only use Mobile network not WIFI)

Apps
  • Download and run CCleaner (on mobile)
Process:
  • Run the cleaning process on CCleaner.
  • Airplane mode off/on (this changes your current mobile IP).
  • Goto Instagram.com on browser sign up, then verify it or which ever you want.
  • Repeat process.


After creation you switch to airplane mode to get a new IP, does Instagram not get suspicious if you login to your just created account with a different IP?
 
After creation you switch to airplane mode to get a new IP, does Instagram not get suspicious if you login to your just created account with a different IP?
u want to login with the old ip at least the first 3x, if its a brand new account (made with 1 ip) and then instantly being used with a new ip right after creation it is considered suspicious activity

BUT dont quote me on IG, this is from FB and PP experience. still seeing as IG and FB is the same company, i would follow the 3x first login rule.

Would love to know if im wrong and IG’s security system is weaker though!
 
Fantastic journey mate. I'm going to PM you something interesting I'm working on ;-)
 
Interesting but i still think they're going to pull uniquely identifying information from your phone (IMEI among others).... Once you start stressing the accounts i think they'll quickly fold....

Very solid journey thread, though. +1
 
u want to login with the old ip at least the first 3x, if its a brand new account (made with 1 ip) and then instantly being used with a new ip right after creation it is considered suspicious activity

BUT dont quote me on IG, this is from FB and PP experience. still seeing as IG and FB is the same company, i would follow the 3x first login rule.

Would love to know if im wrong and IG’s security system is weaker though!
Thanks, how would you do that? Only possible with proxies right? I'm currently running 3 on my own 4G connection and looking to add one. And eventually more
 
Sorry I haven't updated much. But I think I have finished my journey in terms of figuring out their algorithm.

I know you guys are eager to see what I have been up to. I have been working on my main project (this is just a side one).

Anyways, here you go:

img404.jpg


The phone is a s7 edge (screen is busted). I do have different models.

I will be also implementing this to iOS soon.

I have fully automated the creation of accounts - this video is just a demo but the program does the following:

  • Spoofs device ID's
  • Changes IP's
  • Keeps track of used IP's
  • Resets tracking ID's
  • Clean and uninstall Instagram
  • Creates Mail accounts
  • Creates Instragram accounts
  • Has the option to use multiple devices
  • Compatible with Android 6.0+
  • and many more features...

I am giving away some accounts so people can test them and give me feedback.

I might be looking at purchasing a Pi and controlling phones through it.

Please comment down below and tell me if you want to test the accounts- but you must give me feedback.


Thank you for keeping up with this journey, I can guarantee you my follow up to this will be exciting!

Great journey!

How would you do that for IOS? Does device id really matter there?
I have troubles with manually creating multiply accounts on iPhone.
My steps are:
1. delete instagram app
2. clear browser cookie, history etc
3. turn on and off airplane mode to change ip
4. create acc via safari
But anyway, I was able to create only couple of accs and now I am having the error:
"Sorry something went wrong creating your account. Please try again soon."
 
I have many old instagram account that registered on 2013-2017. Never use it, and then i try to promoting my product using hashtag and boost the like. Yes my post show up on top post area, but after 1 hours my post gone, another post can stay over than 1 day, is this shadowban or what?
 
Great journey!

How would you do that for IOS? Does device id really matter there?
I have troubles with manually creating multiply accounts on iPhone.
My steps are:
1. delete instagram app
2. clear browser cookie, history etc
3. turn on and off airplane mode to change ip
4. create acc via safari
But anyway, I was able to create only couple of accs and now I am having the error:
"Sorry something went wrong creating your account. Please try again soon."
"Sorry something went wrong creating your account. Please try again soon." - your account is instant banned on creation and email address is flagged. There is nothing much you can do about it than changing your IP and clearing your browsing history/cookies and trying again until you successfully create an account.

Device ID matter. Since IG can read it it uses it as a sign that you have tons of accounts. For instance if you were to create 100 accounts and if you send same device ID, then IG sees that one device, 1 person is trying to create 100accounts which is not good. By changing ID you trick IG into thinking you are indeed a new user and that you don't have other accounts etc etc But if you are only creating the acocunts on your browser : safari then you don't actually need an IG app. All you need is to bring back the browser to default settings like, to make it clean. You could try to mix different browsers and different email providers as well. GL.


I have many old instagram account that registered on 2013-2017. Never use it, and then i try to promoting my product using hashtag and boost the like. Yes my post show up on top post area, but after 1 hours my post gone, another post can stay over than 1 day, is this shadowban or what?
We don't know your settings mate, it could be because you started to aggressively, maybe you did not do the proper warmup or yet even you did the proper warmup but are going to aggressively overall... Try to cool it of a bit, like removing the URL in your bio, stop with account activity for few days then try again etc.
 
Hey Digital Finger awesome journey, I tried the manual creation you described to insomnijak on Feb 15, though I didnt have any success. (I checked and IP got changed each time) Does it still work for you?
 
Amazing journey! Can't wait to see what happens.

Good luck, bro!
 
If you are doing it manually, I would just suggest the following (only use Mobile network not WIFI)

Apps
  • Download and run CCleaner (on mobile)
Process:
  • Run the cleaning process on CCleaner.
  • Airplane mode off/on (this changes your current mobile IP).
  • Goto Instagram.com on browser sign up, then verify it or which ever you want.
  • Repeat process.

I don't see what value CCleaner does compared to clearing cache of by using the tools available for system. Also would usb tethering to pc for internet and then using sphere browser reach same result except with a little bit more random fingerprint and user agent? For DIY people it would be more convient to also store the user/password.

u want to login with the old ip at least the first 3x, if its a brand new account (made with 1 ip) and then instantly being used with a new ip right after creation it is considered suspicious activity

BUT dont quote me on IG, this is from FB and PP experience. still seeing as IG and FB is the same company, i would follow the 3x first login rule.

Would love to know if im wrong and IG’s security system is weaker though!

Does other's experience support this? I'm rather new on this stuff and haven't come by this previously. Also seems like Digital Finger's test says so far otherwise.

Personally I did try to minimize redflags and well.. failed rather hard as I ended up using sphere browser on proxy and more than 50% of accounts were instantly banned most likely due to proxy's previous heavy usage or my sphere set up didn't fool them. I just can't wrap my head around how Instagram would be fine with people consistently making account on mobile and then travelling over seas without raising a huge red flag.

Also any update? Have you got any pva's or so yet and have you noticed your accounts receiving ads already?
 
Hey there guys,

Forgive me since I have been away for a while.

I will be replying to all your comments. Please note that I will be resuming giving away accounts for testing.

I do however have big updates for you guys:

  • Each account have been registered using their own unique ID's (IMEI, Device Serial (hardware serial), phone number, sim serial, Device Name, Good Tracking ID and many more).
  • Each IP will be registered to only one account to minimise the linking of each account.
  • Each account will have it's own Hotmail and confirmed email.
  • Each account will take approximately 3-5 minutes to create to seem very user like.
  • Each account will follow 10-15 real random people on each account.
  • I could also add BIO to the accounts but I'm not sure it will make a difference.
I have investigated deeply into how Instagram works and what accounts as a Different Device and I can assure you some of the stuff I do is overkill - but it only takes a further 5 seconds to change it.

The accounts I will be giving away will be a mere demo. It will be a complete account to a Female's name however it will not be email verified nor will it be following any account.
Very rarely the account might be banned since I have experimented with using the same IP on two accounts and not changing ID's (other than that they should not be banned).

If asked I will provide you with a .JSON file containing all the information you will need of the account.



Now here comes the replies to all your comments:


i dont know if its anything but on my large account when botting even really slow i get less engagement and reach
turn the bot off for 2-3 days reach and engagement grow
its either that or i DM too many people (got dm blocked a few times)

Unfortunately, I am only experienced in the creation of the accounts and not yet the automation.

Based on the knowledge and comments of others I believe large accounts get less engagement over little ones anyway. Also I have heard of Instagram adding soft blocks to accounts which lowers the engagement levels.

try using multi-login browser, it may work, I don't really know. if it will be able to scan the fingerprints or not.

I have already been through this and had a talk with the Owner. Although it is a wonderful and powerful software, currently I will not be able to use it for this project.

amazing progress man, am interested in some test accounts :)

PM me for further details.
Thanks

Any advice on device anonymity outside of mobile?

I know some bigger companies can see HDD #s, any solutions for that aside from making VMs?

You can spoof your machine but this requires alot of work. I am not even sure you can do so. However I don't think you will need to spoof machine ID's for Instagram just the Prints that a browser can access.

If you want to know further about this Google Finger printing you will see that the information that a browser can currently obtain by using JS, HTML5 etc.

Just read the 5 pages, you rock so hard!
Well done
Interested in an account ✌️

PM me for further details.
How to solve 100 real mobile phone numbers?

Could you elaborate further, I don't understand by how to solve. Do you mean how to automate Phone number verification using real numbers?
@Digital Finger
Hello! can you give me one account per test? thank!

PM me for further details.
Woukd like to test some accs aswell pls

PM me for further details.
Just read all 5 pages, incredible work - Well Done!!

Would love to help you test a couple of accounts on IPv6, just let me know what type of testing you'd like to do :)
PM me for further details.
Question - what are you using to control the android phone? Tasker? Is there some sort of API so that you can remote control taps/keyboard on an Android phone much like selenium can do for browsers?

Question has already been answered on this thread. UIAutomator and MonkeyRunner can be used.
After creation you switch to airplane mode to get a new IP, does Instagram not get suspicious if you login to your just created account with a different IP?

Not at all. Being a Mobile IP this happens for real users aswell. They login using different IP's since they are dynamic IP's.
Great journey!

How would you do that for IOS? Does device id really matter there?
I have troubles with manually creating multiply accounts on iPhone.
My steps are:
1. delete instagram app
2. clear browser cookie, history etc
3. turn on and off airplane mode to change ip
4. create acc via safari
But anyway, I was able to create only couple of accs and now I am having the error:
"Sorry something went wrong creating your account. Please try again soon."

Yes, it does matter on iPhone aswell and it is easier to create Accounts on iPhone than they are on Android due to their Security.
Android can be manipulated in so many ways that I spent alot of time to overcome the problem you are experiencing.
I have many old instagram account that registered on 2013-2017. Never use it, and then i try to promoting my product using hashtag and boost the like. Yes my post show up on top post area, but after 1 hours my post gone, another post can stay over than 1 day, is this shadowban or what?

Your post can be gone depending on the competition of the Hashtag. Remember that Instagram ranks post based on their engagement score and probably more details they have an algorithm that calculates this.


Hey Digital Finger awesome journey, I tried the manual creation you described to insomnijak on Feb 15, though I didnt have any success. (I checked and IP got changed each time) Does it still work for you?

Their algorithm has recently been upgraded, since even I needed to change the way I made accounts. It is now a little harder to create accounts.

I don't see what value CCleaner does compared to clearing cache of by using the tools available for system. Also would usb tethering to pc for internet and then using sphere browser reach same result except with a little bit more random fingerprint and user agent? For DIY people it would be more convient to also store the user/password.



Does other's experience support this? I'm rather new on this stuff and haven't come by this previously. Also seems like Digital Finger's test says so far otherwise.

Personally I did try to minimize redflags and well.. failed rather hard as I ended up using sphere browser on proxy and more than 50% of accounts were instantly banned most likely due to proxy's previous heavy usage or my sphere set up didn't fool them. I just can't wrap my head around how Instagram would be fine with people consistently making account on mobile and then travelling over seas without raising a huge red flag.

Also any update? Have you got any pva's or so yet and have you noticed your accounts receiving ads already?

Yes, you can tether your phone or you can use an LTE stick/module/dongle to get 4G proxies however again that is a problem since you can be fingerprinted through browsers. Sphere browser is good but just to let you know alot of the profiles there are probably overused although I am not too familiar with the program so can comment in depth about it.

Yes, he is right Instagram uses the same algorithm as Facebook I can confirm this.

Also I have checked the accounts I originally made and the ones I was automating have ads showing up now.
 
Inspiring journey, I've took some time to make barebone version of unrooted browser edition for ig, but it's still WIP (lack of monkeyrunner for efficiency and ig's randomization on register with email selection). Do you happen to have any new suggestions related to browser creation?
Figured already ccleaner's hidden cache cleaning reasoning, but could you open up a little bit more? You mention "Good Tracking ID", but that tracking id is still mysterious for me and haven't found any reference about it. About spoofing, do you happen to use XPrivacy for at least some of that unique info spoofing? It would seem to fit the bill on multiple aspects. Also do you log in a couple times in after creation to avoid red flag for new ip? Also how's your accounts doing so far? Still going strong or getting PVA's and/or bans?
 
Inspiring journey, I've took some time to make barebone version of unrooted browser edition for ig, but it's still WIP (lack of monkeyrunner for efficiency and ig's randomization on register with email selection). Do you happen to have any new suggestions related to browser creation?
Figured already ccleaner's hidden cache cleaning reasoning, but could you open up a little bit more? You mention "Good Tracking ID", but that tracking id is still mysterious for me and haven't found any reference about it. About spoofing, do you happen to use XPrivacy for at least some of that unique info spoofing? It would seem to fit the bill on multiple aspects. Also do you log in a couple times in after creation to avoid red flag for new ip? Also how's your accounts doing so far? Still going strong or getting PVA's and/or bans?
I like that you are using that strategy.

Don’t worry about tracking IDs If you are creating accounts via browser on mobile. Xprivacy or XLua only really work for apps I mean you could is it for the browser but it will not make a difference since websites can’t access the kind of IDs we’re talking about.

It still going strong I have no bans or PVAs on creates accounts.

My strategy currently is about automating account creation through the app not through the browser though.
 
Back
Top