instagram_monitor is an OSINT tool for real-time monitoring of Instagram users' activities and profile changes.
- Real-time tracking of Instagram users' activities and profile changes:
- new posts, reels and stories
- changes in followings, followers and bio
- changes in profile pictures
- changes in profile visibility (from private to public and vice versa)
- Anonymous download of users' story images and videos; the user won't know you watched their stories 😉
- Download of users' post images and post / reel videos
- Email notifications for different events (new posts, reels, stories, changes in followings, followers, bio, profile pictures, visibility and errors)
- Attachment of changed profile pictures and stories/posts/reels images directly in email notifications
- Displaying of profile pictures and stories/posts/reels images right in your terminal (if you have
imgcatinstalled) - Saving all user activities and profile changes with timestamps to a CSV file
- Support for both public and private profiles
- Two modes of operation: with or without a logged-in Instagram account
- Various mechanisms to prevent captcha and detection of automated tools
- Possibility to control the running copy of the script via signals
- Requirements
- Installation
- Quick Start
- Configuration
- Usage
- How to Prevent Getting Challenged and Account Suspension
- Change Log
- License
- Python 3.9 or higher
- Libraries: instaloader,
requests,python-dateutil,pytz,tzlocal,python-dotenv
Tested on:
- macOS: Ventura, Sonoma, Sequoia
- Linux: Raspberry Pi OS (Bullseye, Bookworm), Ubuntu 24, Rocky Linux 8.x/9.x, Kali Linux 2024/2025
- Windows: 10, 11
It should work on other versions of macOS, Linux, Unix and Windows as well.
pip install instagram_monitorDownload the instagram_monitor.py file to the desired location.
Install dependencies via pip:
pip install instaloader requests python-dateutil pytz tzlocal python-dotenvAlternatively, from the downloaded requirements.txt:
pip install -r requirements.txt- Track the
target_insta_userin mode 1 (no session login):
instagram_monitor <target_insta_user>Or if you installed manually:
python3 instagram_monitor.py <target_insta_user>- Track the
target_insta_userin mode 2 (with session login via Firefox web browser):
# log in to the Instagram account (your_insta_user) via Firefox web browser
instagram_monitor --import-firefox-session
instagram_monitor -u <your_insta_user> <target_insta_user>To get the list of all supported command-line arguments / flags:
instagram_monitor --helpMost settings can be configured via command-line arguments.
If you want to have it stored persistently, generate a default config template and save it to a file named instagram_monitor.conf:
instagram_monitor --generate-config > instagram_monitor.conf
Edit the instagram_monitor.conf file and change any desired configuration options (detailed comments are provided for each).
In this mode, the tool operates without logging in to an Instagram account.
You can still monitor basic user activity such as new or deleted posts (excluding reels and stories due to Instagram API limitations), bio changes and changes in follower/following counts. However, you won't see which specific followers/followings were added or removed.
This mode requires no setup, is easy to use and is resistant to Instagram's anti-bot mechanisms and CAPTCHA challenges.
In this mode, the tool uses an Instagram session login to access additional data. This includes detailed insights into new posts, reels and stories, also about added or removed followers/followings.
Important: It is highly recommended to use a dedicated Instagram account when using this tool in session login mode. While the risk of account suspension is generally low (in practice, accounts often stay active long-term), Instagram may still flag it as an automated tool. This can lead to challenges presented by Instagram that must be dismissed manually. To minimize any chance of detection, make sure to follow the best practices outlined here.
You can provide your Instagram username (your_insta_user) and password directly in the instagram_monitor.conf configuration file, environment variable or via the -u and -p flags.
However, this triggers a full login every time the tool runs, increasing the chance of detection and account lockouts.
If you store the SESSION_PASSWORD in a dotenv file you can update its value and send a SIGHUP signal to the process to reload the file with the new password without restarting the tool. More info in Storing Secrets and Signal Controls (macOS/Linux/Unix).
A better approach is to use Instaloader to perform a one-time login and save the session:
instaloader -l <your_insta_user>This saves the session locally. However, frequent follower/following/stories changes can still lead to detection, as Instagram may flag this as automated behavior.
The most reliable method is to reuse an existing Instagram session from your Firefox web browser, along with manually specifying the user agent.
Log in to your account (your_insta_user) in Firefox, then run:
instagram_monitor --import-firefox-sessionThe tool will detect available Firefox profiles with a cookies.sqlite file. If multiple profiles are found, it will prompt you to select one, then import the session and save it via Instaloader.
To use a specific Firefox profile path:
instagram_monitor --import-firefox-session --cookie-file "/path/cookies.sqlite"You can adjust the default Firefox cookie directory permanently via FIREFOX_*_COOKIE configuration options.
The session login method using Firefox cookies has the added benefit of blending tool activity with regular user behavior. Interacting with Instagram via Firefox every few days (scrolling, liking posts etc.) helps maintain session trust. However, avoid overlapping browser activity with tool activity, as simultaneous actions can trigger suspicious behavior flags.
It is also recommended to use the exact user agent string from your Firefox web browser:
- open Firefox and type
about:supportin the address bar - find the
User Agentvalue under theApplication Basicssection and copy it - set this value via the
USER_AGENTconfiguration option or by using the--user-agentflag
By default, time zone is auto-detected using tzlocal. You can set it manually in instagram_monitor.conf:
LOCAL_TIMEZONE='Europe/Warsaw'You can get the list of all time zones supported by pytz like this:
python3 -c "import pytz; print('\n'.join(pytz.all_timezones))"If you want to use email notifications functionality, configure SMTP settings in the instagram_monitor.conf file.
Verify your SMTP settings by using --send-test-email flag (the tool will try to send a test email notification):
instagram_monitor --send-test-emailIt is recommended to store secrets like SESSION_PASSWORD or SMTP_PASSWORD as either an environment variable or in a dotenv file.
Set the needed environment variables using export on Linux/Unix/macOS/WSL systems:
export SESSION_PASSWORD="your_instagram_session_password"
export SMTP_PASSWORD="your_smtp_password"On Windows Command Prompt use set instead of export and on Windows PowerShell use $env.
Alternatively store them persistently in a dotenv file (recommended):
SESSION_PASSWORD="your_instagram_session_password"
SMTP_PASSWORD="your_smtp_password"By default the tool will auto-search for dotenv file named .env in current directory and then upward from it.
You can specify a custom file with DOTENV_FILE or --env-file flag:
instagram_monitor <target_insta_user> --env-file /path/.env-instagram_monitorYou can also disable .env auto-search with DOTENV_FILE = "none" or --env-file none:
instagram_monitor <target_insta_user> --env-file noneAs a fallback, you can also store secrets in the configuration file or source code.
To monitor specific user activity in mode 1 (no session login), just type Instagram username as a command-line argument (target_insta_user in the example below):
instagram_monitor <target_insta_user>To monitor specific user activity in mode 2 (with session login), you also need to specify your Instagram account name (your_insta_user in the example below) via SESSION_USERNAME configuration option or -u flag:
instagram_monitor -u <your_insta_user> <target_insta_user>By default, the tool looks for a configuration file named instagram_monitor.conf in:
- current directory
- home directory (
~) - script directory
If you generated a configuration file as described in Configuration, but saved it under a different name or in a different directory, you can specify its location using the --config-file flag:
instagram_monitor <target_insta_user> --config-file /path/instagram_monitor_new.confThe tool runs until interrupted (Ctrl+C). Use tmux or screen for persistence.
You can monitor multiple Instagram users by launching multiple instances of the script.
The tool automatically saves its output to instagram_monitor_<username>.log file. It can be changed in the settings via INSTA_LOGFILE configuration option or disabled completely via DISABLE_LOGGING / -d flag.
The tool in mode 2 (session login) also saves the list of followings & followers to these files:
instagram_<username>_followings.jsoninstagram_<username>_followers.json
Thanks to this we do not need to re-fetch it every time the tool is restarted and we can also detect changes since the last usage of the tool.
The tool also saves the user profile picture to instagram_<username>_profile_pic*.jpeg files.
It also saves downloaded posts/reels images & videos to:
instagram_<username>_post/reel_YYYYmmdd_HHMMSS.jpeginstagram_<username>_post/reel_YYYYmmdd_HHMMSS.mp4
And downloaded stories images & videos to:
instagram_<username>_story_YYYYmmdd_HHMMSS.jpeginstagram_<username>_story_YYYYmmdd_HHMMSS.mp4
To enable email notifications for various events (such as new posts, reels and stories, changes in followings, bio updates, changes in profile picture and visibility):
- set
STATUS_NOTIFICATIONtoTrue - or use the
-sflag
instagram_monitor <target_insta_user> -sTo also get email notifications about changed followers:
- set
FOLLOWERS_NOTIFICATIONtoTrue - or use the
-mflag
instagram_monitor <target_insta_user> -mTo disable sending an email on errors (enabled by default):
- set
ERROR_NOTIFICATIONtoFalse - or use the
-eflag
instagram_monitor <target_insta_user> -eMake sure you defined your SMTP settings earlier (see SMTP settings).
Example email:
If you want to save all Instagram user's activities and profile changes to a CSV file, set CSV_FILE or use -b flag:
instagram_monitor <target_insta_user> -b instagram_username.csvThe file will be automatically created if it does not exist.
The tool can detect when a monitored user changes their profile picture. Notifications appear in the console and (if the -s flag is enabled) via email.
This feature is enabled by default. To disable it, either:
- set the
DETECT_CHANGED_PROFILE_PICtoFalse - or use the
-kflag
Since Instagram periodically changes the profile picture URL even when the image is the same, the tool performs a binary comparison of JPEG files to detect actual changes.
On the first run, it saves the current profile picture to instagram_<username>_profile_pic.jpeg
On each subsequent check a new image is fetched and it is compared byte-for-byte with the saved image.
If a change is detected, the old picture is moved to instagram_<username>_profile_pic_old.jpeg and the new one is saved to:
instagram_<username>_profile_pic.jpeg(current)instagram_<username>_profile_pic_YYmmdd_HHMM.jpeg(for history)
The tool also has built-in detection of empty profile pictures. Instagram does not indicate an empty user's profile image in their API; that's why the tool detects it by using an empty profile image template (which appears to be identical on a binary level for all users).
To enable this:
- download the instagram_profile_pic_empty.jpeg file
- place it in the directory where you run the tool (or change the path via
PROFILE_PIC_FILE_EMPTYconfiguration option)
Without this file, the tool will treat an empty profile picture as a regular image. For example, if a user removes their profile picture, it would be treated as a change rather than a removal.
If you have imgcat installed, you can use the feature of displaying profile pictures and stories/reels/posts images right in your terminal.
To do this, set the path to your imgcat binary in the IMGCAT_PATH configuration option.
If you specify only the binary name, it will be auto-searched in your PATH.
Set it to empty to disable this feature.
If you want to customize polling interval, use -c flag (or INSTA_CHECK_INTERVAL configuration option):
instagram_monitor <target_insta_user> -c 3600It is generally not recommended to use values lower than 1 hour as it will be quickly picked up by Instagram automated tool detection mechanisms.
In order to make the tool's behavior less suspicious for Instagram, by default the polling interval is randomly picked from the range:
[ INSTA_CHECK_INTERVAL (-c) - RANDOM_SLEEP_DIFF_LOW (-i) ]
⇄
[ INSTA_CHECK_INTERVAL (-c) + RANDOM_SLEEP_DIFF_HIGH (-j) ]
This means each check will happen after a random delay centered around INSTA_CHECK_INTERVAL with some variation defined by RANDOM_SLEEP_DIFF_LOW and RANDOM_SLEEP_DIFF_HIGH.
So having the check interval set to 1 hour (-c 3600), RANDOM_SLEEP_DIFF_LOW set to default 15 mins (-i 900) and RANDOM_SLEEP_DIFF_HIGH set to default 3 mins (-j 180) means that the check interval will be with every iteration picked from the range of 45 mins to 1 hour and 3 mins.
That's why the check interval information is printed in the console and email notifications as it is essentially a random number.
On top of that you can also define that checks for new posts / reels should be done only in specific hour ranges by setting CHECK_POSTS_IN_HOURS_RANGE to True and then defining proper values for MIN/MAX_H1/H2 configuration options (see the comments in the configuration file for more information).
The tool has several signal handlers implemented which allow to change behavior of the tool without a need to restart it with new configuration options / flags.
List of supported signals:
| Signal | Description |
|---|---|
| USR1 | Toggle email notifications for new posts, reels & stories, changed followings, bio, profile picture, visibility (-s) |
| USR2 | Toggle email notifications for new followers (-m) |
| TRAP | Increase the user activity check interval (by 5 mins) |
| ABRT | Decrease the user activity check interval (by 5 mins) |
| HUP | Reload secrets from .env file |
Send signals with kill or pkill, e.g.:
pkill -USR1 -f "instagram_monitor <target_insta_user>"As Windows supports limited number of signals, this functionality is available only on Linux/Unix/macOS.
You can use GRC to color logs.
Add to your GRC config (~/.grc/grc.conf):
# monitoring log file
.*_monitor_.*\.log
conf.monitor_logs
Now copy the conf.monitor_logs to your ~/.grc/ and log files should be nicely colored when using grc tool.
Example:
grc tail -F -n 100 instagram_monitor_<username>.logAs mentioned earlier it is highly recommended to use a dedicated Instagram account when using this tool in session login mode. While the risk of account suspension is generally low (in practice, accounts often stay active long-term), Instagram may still flag it as an automated tool. This can lead to challenges presented by Instagram that must be dismissed manually.
To minimize any chance of detection, make sure to follow the best practices outlined below.
Use your Firefox web browser to log in, ensuring the session looks natural and consistent to Instagram. Follow instructions described here
Always pass the exact web browser user agent string from your Firefox web browser by using USER_AGENT configuration option or the --user-agent flag. This helps maintain device consistency during automated actions. Follow instructions described here
Since v1.7, the tool includes a new experimental Be Human mode that makes it behave more like a real user to reduce bot detection.
It is disabled by default, but you can enable it via BE_HUMAN configuration option or --be-human flag.
It is used only with session login (mode 2).
After each check cycle, the tool will randomly do one or more of these harmless actions:
- View your explore feed: pulls a single post from Instagram's explore feed
- Open your own profile, as if tapping your avatar
- Browse a hashtag: fetches one post from a random tag listed in
MY_HASHTAGSconfiguration option - Look at a profile of someone you follow
By default it does around 5 of these actions spread over 24 hours, but you can adjust it via DAILY_HUMAN_HITS option.
If you are interested in your human actions set BE_HUMAN_VERBOSE option to True.
Since v.1.7, the tools allows to force every HTTP call made by Instaloader to go through a built-in jitter/back-off layer to look more human.
This adds random delay (0.8-3 s) before each request and automatically retries on Instagram's 429 "too many requests" or checkpoint challenges, with exponential back-off (60 s → 120 s → 240 s) and a little extra jitter.
This significantly reduces detection risk, but also makes the tool slower.
You can enable this feature via ENABLE_JITTER configuration option or --enable-jitter flag.
If you want to see verbose output for HTTP jitter/back-off wrappers set JITTER_VERBOSE option to True.
Avoid setting the polling interval (INSTA_CHECK_INTERVAL option or -c flag) too aggressively. Use a minimum of 1 hour - longer is better. For example, I set it to 12 hours on test accounts, resulting in only 2 checks per day.
Also consider to randomize the check interval, as explained here.
It is recommended to limit the number of users monitored by a single account, especially if they post frequent updates. In some cases, it may be best to create a separate account for additional users and even run it from a different IP address to reduce the risk of detection.
Frequent updates to certain data types, such as new stories or changes in followers/followings, are more likely to flag the account as an automated tool. If certain data isn't essential for your use case, consider disabling its retrieval. The tool provides fine-grained control, for example you can skip fetching the list of followings (-g flag), followers (-f), stories details (-r) or posts/reels details (-w).
Activate 2FA on the account used for monitoring. It adds credibility to your account and reduces the likelihood of security flags.
Refrain from logging in via VPNs, especially with IPs in different regions. Sudden location changes can trigger Instagram's security systems.
If you have created a new account for monitoring and you are using Session Login Using Firefox, make sure to behave like a regular user for several days. New accounts are more closely monitored by Instagram's bot detection systems. Watch content, post stories or reels and leave comments - this helps establish a natural activity pattern.
Once you start using the tool, try to blend its actions with normal usage. However, avoid overlapping browser activity with tool activity, as simultaneous actions can trigger suspicious behavior flags.
See RELEASE_NOTES.md for details.
Licensed under GPLv3. See LICENSE.