Facebook sues operator of Instagram clone sites

Facebook has today filed another lawsuit against a company acting in violations of its terms of service. In this case, the company has sued Ensar Sahinturk, a Turkish national who operated a network of Instagram clone sites, according to court filings. Facebook says Sahinturk used automation software to scrape Instagram users’ public profiles, photos and videos from over 100,000 accounts without permission, and this data was then published on his network of websites.

In the filing, Facebook says it became aware of the clone website network a year ago, in November 2019. It learned that the defendant had controlled a number of domains, many with names that were similar to Instagram, including jolygram.com, imggram.com, imggram.net, finalgram.com, pikdo.net and ingram.ws. The first in that list, jolygram.com, had been in use since August 2017. The others were registered in later years as the network expanded. Finalgram.com was the latest that was put to use and has been in operation since October 2019.

Facebook doesn’t say how large these sites were, in terms of visitors, but described the clone network to TechCrunch as having “voluminous traffic.”

In addition to being what Facebook claims are trademark violations associated with these domains, the sites were populated with data that was pulled from Instagram’s website through automated scraping — that is, via specialized software that pretends to be a human instead of a bot to access data.

The defendant was able to evade Instagram’s security measures against automated tools of this nature by making it look like the requests to Facebook’s servers were coming from a person using the official Instagram app, the complaint states.

The defendant had programmed his scraping software by creating and using thousands of fake Instagram accounts that would mimic actions that real, legitimate users of the Instagram app could have taken. Facebook said the number of fake accounts used daily could be very high. On April 17, 2020, the defendant used over 7,700 accounts to make automated requests to Facebook servers, for example. On April 22, 2020, he used over 9,000.

On the clone websites created, users were able to enter in any Instagram username and then view their public profiles, photos, videos, Stories, hashtags and location. The clone sites also allowed visitors to download the pictures and videos that had been posted on Instagram, a feature that Instagram doesn’t directly offer. (Its official website and app don’t offer a “save” button.)

Facebook attempted to protect against these various terms of service violations in 2019, when it disabled approximately 30,000 fake Instagram accounts operated by the defendant. It also sent a series of cease-and-desist letters and shut down further Instagram and Facebook accounts, including one Facebook Page belonging to the defendant. However, the defendant claimed he didn’t operate jolygram.com, it was just registered under his name. But he also said he had shut it down.

Facebook claims the resources it used to investigate and attempt to resolve the issues with the defendant’s operations have topped $25,000 and is asking for damages to be determined during the trial.

The lawsuit is now one of many Facebook has filed in the years that followed the Cambridge Analytica scandal, where millions of Facebook users’ data was harvested without their permission. Facebook has since sued analytics firms misusing its data, developers who violated its terms to sell fake “Likes,” and other marketing intelligence operations. However, the company tells TechCrunch this is the first Instagram lawsuit against clone websites.