{
  "id": 5315892,
  "title": "Inside Instagram's Anti-Bot Stack: What Actually Catches You",
  "url": "https://urgent.news/2026/09/03/inside-instagrams-anti-bot-stack-what-actually-catches-you",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-03T11:11:48.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/2xtract_dev/inside-instagrams-anti-bot-stack-what-actually-catches-you-2ldd"
  },
  "original_language": "en",
  "account": "Meta's anti-bot protection operates like a stack of independent checks, each examining a different aspect of the connection. While the wall analogy is often used to describe anti-bot protection, a closer analogy is to a stack of layers, each reading a unique part of the connection. Some layers cost more to run for the operator, while others are cheaper for the client to defeat.\n\nHere are the key layers of Meta's stack, starting from the cheapest and most trivial to the most expensive:\n\n1. TLS handshake (JA3/JA4): Low cost, trivial to implement\n2. HTTP/2 connection preface: Low cost, trivial to implement\n3. IP and ASN reputation: Medium cost, cheap to implement\n4. Browser surface consistency: Medium cost, cheap to implement\n5. Client attestation (mobile): Very high cost, cheap to implement\n6. Behavioral telemetry: High cost, moderate to implement\n7. Account graph position: Practically impossible, expensive to implement\n\nMost anti-detection tooling focuses on the first four layers. Accounts are typically defeated at the fifth to seventh layers. The ordering of these layers follows a simple rule: a signal's value is determined by the cost it imposes on the attacker, not the cost to the defender to collect it.\n\nLayers 1 and 2 describe the client before any data is sent. The TLS ClientHello contains details about the client's stack, such as cipher list and order, extensions, supported groups, signature algorithms, ALPN. These details remain consistent even if the IP address changes or headers are spoofed. The JA4 fingerprint, from FoxIO, encodes this information into a partly readable string, unlike JA3's opaque hash.\n\nThe HTTP/2 connection preface also provides valuable information, including the SETTINGS frame contents and ordering, initial WINDOW_UPDATE increment, unsolicited PRIORITY frames, and the order of request pseudo-headers. These details differentiate between browsers like Chrome, Firefox, Go's standard library, and curl.\n\nMoving on to layer 3, IP and ASN reputation hold more weight in proxy marketing than in actual effectiveness. Datacenter ASNs with a high volume of logins in a short period present a strong prior, while residential ASNs with fewer connections provide a weak prior. Addresses alone do not decide anything, as they are often shared among multiple users. However, when combined with account history, they can serve as consistency signals.\n\nLayer 4 focuses on browser surface consistency, which is often misunderstood as a uniqueness problem. Instead, the stronger signal lies in internal contradictions. FP-Scanner, as described in Vastel et al.'s USENIX Security 2018 paper, demonstrated that countermeasures often defeat themselves. By altering browser attributes, unique combinations can be created that would not occur naturally. Their consistency battery accurately detected spoofing tooling against an 0.45 accuracy rate for FingerprintJS2, consistently identifying the real browser family.\n\nLayer 5 involves client attestation, which is crucial for mobile users. Browsers serve as hostile execution environments, as they can be manipulated by the site. Native apps, on the other hand, benefit from hardware-based security. Google's Play Integrity API provides a signed verdict on Android 13 and above, verifying if the device is locked with a certified manufacturer image. Apple's App Attest uses the Secure Enclave to achieve a similar result. If an account appears from multiple ASNs in a short timeframe, it raises a consistency signal, indicating a potential bot.",
  "summary": "Anti-bot protection is usually described as a wall. It is closer to a stack of independent checks, each reading a different part of the connection, each costing the operator something different to run and the automated client something different to defeat. Meta's stack makes a good case study because an unusual amount of it is documented in public, in research papers and vendor specifications.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}