My follow bot got CAPTCHA-banned — convincing them it isn't a machine

I was running a headless follow bot to grow social accounts. Not by driving an app through an API — by touching a real phone's screen directly over adb: open the search screen, tap a result, go through the avatar popup, hit the follow button. In timed bursts every hour. I covered this adb direct-drive setup before, and even jittered every touch by a few pixels to erase the fingerprint.

Then one day Instagram slapped a CAPTCHA checkpoint on an account. Banned. After all that work to look human.

One question. If your automation is built to "look human" — how fast and how indiscriminately does that human act? I made the touches look human, but the rhythm of the behavior was nothing like a person.

What it was doing

Two tracks. One searched Threads for specific keywords and followed the targets; the other cycled through four Instagram accounts via the account switcher. Touch jitter, safe zones, foreground guards — all the human-mimicry pieces were already in.

So I'd fooled myself into thinking "human-shaped touches" were the core of the defense. They weren't.

The real cause of the ban

What would you suspect? Touch coordinates? Scroll speed? I walked back through the logs and pulled out three things.

• Cold follows. Following strangers indiscriminately. People usually follow within a context — something they searched, someone they know. Indiscriminate following is itself a bot signal.
• Burst speed. The gaps between actions inside a burst were too tight.
• Volume. The per-hour follow cap was too high for a human.

No amount of touch jitter mattered when the rhythm and the indiscriminateness were machine.

What I changed

• Cold-follow OFF (DISCOVER=False): no more blindly following strangers. Only context-bound targets, like search results.
• Burst throttle guard + wider gaps: spaced actions out to a human rhythm.
• Lower per-hour cap (cap 6): cut the volume.
• Kept touch jitter: coordinate wobble stays.
• A ban-response gate: touch an .ig_paused file and only Instagram halts while Threads keeps running; rm it to resume. A CAPTCHA is per-account and per-device — it can't be auto-cleared. You solve it on the phone by hand.

And one trap. Stopping the process with kill $(cat .lock) kills a burst mid-run. The lock file is for preventing double-runs, not a kill switch. Stopping must go through the .ig_paused gate.

A 3-line self-check

If you run headless social automation, look at these first.

1. Are you cold-following? (Context-free indiscriminate action = the number-one bot signal.)
2. Are the gaps between touches/actions identical every time? (Rhythm is a fingerprint too, not just coordinates.)
3. When one account gets flagged, do you have a gate that stops only that account — without killing everything?

The honest takeaway

The moment you set the goal to "how many," you start sprinting toward a ban. The real goal was "not flagged, and steady." Looking human isn't the shape of a touch — it's the restraint of the behavior: not following strangers blindly, not rushing, doing a moderate amount.

At least the ban pinged me on Telegram immediately. Without that, I'd have left a dead account sitting for days.