An agency runs 180 managed Instagram profiles across a single rotating residential subscription. Likes run fine. Follows run fine. Then the team switches on direct message outreach for a client campaign, and within 48 hours roughly a third of the accounts are sitting on action blocks, with a handful landing in permanent restriction. Nothing changed about the proxies. What changed was the action mix.
This is the part of Instagram automation that most operators get wrong. They treat the proxy as a single binary decision: residential or mobile, clean or dirty, banned or not banned. In reality Instagram applies different scrutiny to different action types, and those action types carry wildly different network expectations. A like is cheap. A follow is moderately expensive. A cold DM is the single most heavily policed action on the platform short of account creation itself.
If your IP strategy does not reflect that hierarchy, you are either overpaying for mobile bandwidth on low-risk actions or underprotecting the high-risk ones. This article breaks down how Instagram's 2026 enforcement model actually scores behaviour, how to map pool types to action classes, and how to size concurrency so your infrastructure cost tracks your real risk exposure.
How Instagram Counts Actions in 2026
The old mental model of Instagram rate limiting was a simple counter: X follows per hour, Y likes per day, block at the threshold. That model has not been accurate for years, and in 2026 it is actively misleading.
What Instagram runs now is closer to a continuous trust score per account, recalculated on a rolling basis and fed by several independent signal families:
Action velocity and burstiness. Not just how many actions, but their distribution. Forty follows spread across nine hours with irregular gaps reads very differently from forty follows in three evenly spaced bursts of thirteen.
Action mix ratio. Accounts that only follow, or only DM, look mechanical. Genuine users scroll, watch stories, pause, like a few things, and occasionally follow someone. The ratio of passive consumption to active engagement is itself a feature in the model.
Target quality. Following accounts that have no relationship to your profile's topical graph, or DMing users who have never interacted with you, raises the cost of each action. The same follow count against a warm audience produces a far lower risk score.
Network and device continuity. This is where proxies enter. Instagram correlates the IP, its ASN, its reputation history, the device fingerprint, and the consistency between them over time. An account that has lived on one carrier IP range for six weeks and suddenly appears on a datacenter ASN in another country is making a statement about itself.
Recipient feedback. Especially for DMs. Report rates, delete rates, and non-response rates all feed back into the sender's score. This is the signal that catches outreach campaigns that look technically perfect.
The practical consequence is that there is no universal safe number. Published "limits" circulating in automation communities (roughly 150 to 200 follows per day on an aged account, 300 to 500 likes, 30 to 50 cold DMs) are observed ceilings for well-warmed profiles on stable IPs, not guarantees. A three-week-old account on a shared datacenter IP will trip at a fraction of those numbers. An aged account on a dedicated mobile IP with a consistent fingerprint can often sustain the upper end indefinitely.
The Three Action Classes and Their Risk Profiles
To design an IP strategy, first separate actions by how much platform attention they attract.
Class 1: Passive and low-cost engagement
Likes, story views, saves, profile visits, feed scrolling, and video watch time. These are high-volume, low-consequence actions. They are also the actions Instagram uses to decide whether an account looks human at all, which means you want plenty of them.
Risk profile: low per action, but volume is visible. A profile that performs 800 likes and zero other activity still looks wrong. Network expectation: moderate. These actions tolerate rotating residential IPs and even high-quality ISP IPs reasonably well, provided the session does not change IP mid-interaction.
Class 2: Graph-modifying actions
Follows, unfollows, comments, and story replies. These change the social graph or create visible public artifacts, so Instagram scrutinises them more heavily. Unfollow in particular is a flagged behaviour because follow/unfollow churn is the signature of a growth tool.
Risk profile: medium to high. Action blocks on follows are the most common penalty operators encounter. Network expectation: high. These actions benefit significantly from IP stability. An account that follows 40 accounts from four different IPs in four different cities during a single afternoon is generating a correlation signal that is trivially easy to detect.
Class 3: Direct messaging and account mutations
Cold DMs, bulk DM campaigns, bio and link changes at scale, and anything involving account creation or recovery. This is the highest-scrutiny tier, and the gap between Class 2 and Class 3 is wider than most operators expect.
Risk profile: severe. DM restrictions escalate fast, often skipping the temporary action block and going straight to messaging restrictions that persist for weeks. Network expectation: maximum. In practice this means dedicated mobile IPs or dedicated residential IPs with long session persistence, one account per IP, and no sharing across clients or campaigns.
The mistake in the opening scenario was running Class 3 actions on infrastructure provisioned for Class 1. The rotating pool was perfectly adequate for likes. It was never going to survive a DM campaign.
Matching Pool Types to Action Classes
Four pool types matter here, and each has a defensible role.
Mobile proxies
Carrier-grade NAT means thousands of real Instagram users share the same public IP at any moment. That makes mobile IPs structurally hard to penalise: blocking one punishes legitimate customers of the carrier. For Instagram specifically, mobile IPs also align with the overwhelmingly mobile-first usage pattern the platform expects.
Use mobile for: Class 3 actions, high-value accounts, account warm-up, recovery flows, and any profile where a ban costs more than the monthly proxy spend. The constraint is cost and bandwidth. Mobile is the most expensive per unit, so running 500 accounts of low-value liking activity over mobile is simply burning budget.
Allocation guidance: one to three accounts per dedicated mobile IP for DM-heavy work. Shared mobile pools can stretch further for passive activity, but the moment you add messaging, tighten the ratio.
Residential proxies
Real consumer IPs from ISP subscribers, typically rotating but available with sticky sessions. The breadth of geographic coverage is the main advantage: you can match an account's claimed location to a plausible residential IP in the right city, which matters enormously for localised growth campaigns.
Use residential for: Class 1 and Class 2 activity on mid-value accounts, geo-targeted growth where city-level matching matters, and scraping adjacent to growth work (hashtag discovery, competitor audience analysis, engagement rate verification).
The critical configuration detail is session length. Rotating every request destroys Instagram automation. You want sticky sessions measured in tens of minutes at minimum, ideally aligned to the duration of a complete simulated browsing session.
ISP proxies
Static IPs hosted in datacenters but registered to consumer ISP ASNs. They combine datacenter speed and uptime with residential-looking ASN attribution, and because they are static they give you perfect IP continuity for an account.
Use ISP for: long-lived accounts that need a stable "home" IP, content posting and scheduling, and Class 1 and Class 2 activity where predictable latency matters. ISP proxies are a strong middle tier: cheaper than mobile, more stable than rotating residential.
The caveat is that ISP ranges are finite and known. A heavily used ISP subnet accumulates reputation damage over time, so subnet diversity matters more here than with mobile.
Datacenter proxies
Fast, cheap, and immediately identifiable by ASN. For logged-in Instagram sessions, datacenter IPs are a liability.
Use datacenter for: nothing involving a logged-in account. They remain useful for public data collection around your growth work, such as pulling public profile metrics, hashtag volume checks, or monitoring competitor posting cadence. Keep that traffic on separate infrastructure entirely so that scraping-related blocks never touch your account IPs.
Building the Allocation Model
Here is a practical way to size infrastructure rather than guessing.
Step one: tier your accounts by replacement cost. A brand's primary profile with 80,000 followers and a verified business link is irreplaceable. A throwaway engagement account is worth a few dollars. Tier accordingly: tier A (irreplaceable), tier B (expensive to rebuild), tier C (disposable).
Step two: assign action classes per tier. Tier A accounts typically run Class 1 and Class 2 only, with DMs handled manually or at very low volume. Tier C accounts absorb the aggressive Class 2 and Class 3 workloads because their loss is budgeted for.
Step three: map tiers to pools. Tier A goes on dedicated static IPs, ISP or mobile, one account per IP, never shared. Tier B goes on sticky residential sessions with a ratio of around three to five accounts per IP, segmented by geography. Tier C can run higher density on shared mobile or residential, accepting a higher attrition rate.
Step four: calculate bandwidth, not just IP count. Instagram automation is media-heavy. A browser-based session that loads feeds, stories, and reels consumes far more data than an API-style client. Budget realistically: a full browser session performing an hour of human-like activity can consume 150 to 400 MB depending on how much video it touches. Multiply by accounts and sessions per day before committing to a plan.
Step five: enforce isolation boundaries. No client's accounts should ever share an IP with another client's. No tier A account should share a subnet with a tier C account. Subnet-level clustering is how a handful of aggressive accounts drag an entire portfolio into a blocklist.
Session Architecture: The Detail That Decides Outcomes
Pool type is necessary but not sufficient. How you use the IP matters as much as which IP you use.
One account, one IP, consistently. The strongest predictor of account longevity in multi-account Instagram operations is IP continuity. An account should see the same IP, or at minimum the same subnet and the same city, across sessions. Changing IPs is acceptable when it mirrors real life (a user travelling, switching from home wifi to mobile data), but those changes should be rare and plausible.
Session duration should match human behaviour. A real session on Instagram lasts somewhere between two and twenty minutes. Set sticky session TTL longer than your longest planned session so the IP never rotates mid-flow. A rotation that happens between a like and the follow that logically followed it is a hard signal.
Action pacing inside the session. Spread Class 2 actions across the session rather than front-loading them. Interleave passive actions. Introduce variance in delays, not just randomness within a narrow band. Real users have long pauses, aborted actions, and repeated profile visits before they follow.
Respect the diurnal cycle of the IP's geography. An account on a Berlin residential IP performing 200 actions at 4am local time is contradicting its own location claim. Schedule activity windows per timezone.
Keep the fingerprint aligned with the network. Mobile IP plus desktop browser fingerprint is a contradiction. Mobile IP plus a mobile device profile plus a timezone and locale consistent with the carrier's country is coherent. This alignment work is not optional at scale.
Common Mistakes That Get Portfolios Wiped
Treating all actions as one budget. The most expensive error. Teams calculate "actions per day per account" as a single number and distribute them without weighting. Follows and DMs need separate, much tighter budgets than likes.
Running DM campaigns on rotating pools. A DM sent from one IP and a follow-up sent from another twenty minutes later is a correlation gift. Messaging workloads need session persistence measured in hours, not minutes.
Ignoring unfollow velocity. Operators carefully pace follows and then unfollow 300 accounts in a batch overnight. Unfollow is a Class 2 action and deserves the same pacing discipline.
Scaling before warming. New accounts on fresh IPs performing full-volume activity on day one is the fastest path to mass bans. Both the account and the IP relationship need an establishment period.
Sharing proxies across tools. Using the same IP for the automation browser, a scraping script, and a mobile emulator produces conflicting fingerprints on a single address. Segment by workload.
No measurement loop. If you cannot see which pool, subnet, and action class correlate with your blocks, you are tuning blind. Log the IP, ASN, session ID, action type, and outcome for every action, and review weekly.
Where Proxies Fit In
Everything above reduces to a provisioning problem: you need several distinct pool types, available in the right countries and cities, with session control you can configure per workload, and billing you can forecast. Most teams discover that buying one pool type from one source and forcing it to cover every action class is what creates their failures.
This is the practical argument for a provider that operates multiple pools under one account. EnigmaProxy runs residential, ISP, datacenter, and mobile pools together, which means the tier A accounts can sit on static IPs while the tier C workload runs on rotating residential, and the DM campaigns run on mobile, without stitching together three vendor relationships and three separate billing cycles. Session control and geographic targeting are the features that matter most for this use case, because the entire strategy depends on being able to hold an IP steady for a defined window and to place it in a plausible location.
Sourcing matters too, and not only for ethical reasons. Pools assembled without informed consent from the end users tend to be unstable, carry contaminated reputation, and are increasingly subject to enforcement action that can remove large IP ranges from availability overnight. Choosing ethically sourced residential proxies is partly a compliance decision and partly an operational one: consented pools behave more predictably over the months-long timescales that Instagram account management runs on.
On budgeting, the thing to model is bandwidth per account per day multiplied by your account count, then checked against pricing tiers before you scale. Growth automation costs are dominated by media-heavy browser sessions, so a plan that looks generous on a spreadsheet of request counts can be consumed far faster in practice. Build the forecast on megabytes, not on actions.
Strategic Shifts to Prepare For
Behavioural scoring keeps displacing IP scoring. IP reputation remains a gate, but it is increasingly a necessary rather than sufficient condition. Platforms are investing in sequence models that profile interaction timing, scroll patterns, and tap coordinates. Clean IPs with robotic behaviour will fail. Plan for behaviour simulation as a first-class engineering problem, not an afterthought.
DM enforcement is tightening faster than follow enforcement. Cold outreach volume on Instagram has attracted regulatory attention alongside platform enforcement in several jurisdictions. Expect lower ceilings, faster escalation, and more weight on recipient feedback. Teams building growth products should design for a future where cold DM volume is a fraction of today's.
IPv6 adoption on mobile networks changes the NAT calculus. As carriers move to IPv6 with less aggressive address sharing, part of the structural protection that mobile IPs offer may erode. Watch for pools that maintain genuine IPv4 carrier NAT, and test IPv6 carrier IPs separately rather than assuming equivalence.
Consent and provenance become procurement requirements. Enterprise buyers and agencies with regulated clients are starting to ask for sourcing documentation before signing. Expect this to move from a differentiator to a baseline expectation, and expect pools with unclear provenance to become harder to buy at scale.
Fingerprint and network coherence becomes the audit standard. The teams that survive are the ones that treat each managed account as a complete identity: device profile, network path, locale, behaviour schedule, and content strategy, all consistent. Partial coherence is the new failure mode.
Conclusion
Instagram growth automation fails on infrastructure far more often than it fails on tooling. The automation logic is usually fine. What breaks is the mismatch between how heavily a platform polices a given action and how much network protection that action was given.
The fix is straightforward to state and genuinely demanding to implement. Classify your actions by the scrutiny they attract. Tier your accounts by what their loss would actually cost. Map pool types to those tiers rather than buying one pool and hoping. Hold sessions stable for long enough that an account's network history makes sense. Measure outcomes by pool, subnet, and action type so you are tuning on evidence rather than folklore.
Done properly, this is not an expense problem so much as an allocation problem: mobile where it is justified, ISP where stability matters, residential where geography matters, and datacenter nowhere near a logged-in session. Working with a provider such as EnigmaProxy that offers those pools under consistent terms and with transparent sourcing makes the allocation model practical to run rather than theoretical.