This screenshot shows a phishing page impersonating Instagram, designed to steal login credentials (phone number, username, email, and password). The page is hosted on a suspicious domain unrelated to Instagram.
Threat Analysis: Instagram Phishing – Credential Harvesting
How it works:
The victim receives a phishing email, SMS, or social media message claiming a security alert, account issue, or the need to verify their information. The link leads to this page, which mimics the Instagram login interface. The victim is asked to enter their phone number, username, or email and password, then click “Log in.” The credentials are captured and sent to the attacker.
The goal:
The attacker steals Instagram account credentials to:
- Access private messages and personal information
- Post spam, scams, or malicious links from a trusted account
- Use the account to send further phishing messages to the victim’s followers
- Attempt credential reuse on other platforms (email, banking, etc.)
Red flags to watch for:
- Suspicious URL: The page is hosted on
kannage.xyz, notinstagram.com. Legitimate Instagram login pages are only on official Instagram / Meta domains. - Generic design: While the page copies Instagram’s layout, the domain and lack of security indicators (e.g., valid SSL certificate matching Instagram) reveal its fraudulent nature.
- Unsolicited login request: Instagram does not send links requiring users to log in to resolve account issues or claim rewards.
- No personalization or two‑factor prompt: A real Instagram login may show a profile photo or ask for a verification code – this page does not.
What to do if you encounter this:
- Do not enter your username, phone number, email, or password.
- If you have already entered your credentials, change your Instagram password immediately and enable two‑factor authentication (2FA). Also check for any unauthorized activity or connected apps.
- Always access Instagram by typing
instagram.comdirectly into your browser or using the official app.
Protective measures:
- Bookmark the official Instagram login page and use that bookmark.
- Use a password manager – it will autofill only on legitimate
instagram.comdomains. - Enable two‑factor authentication on your Instagram account.
- Be suspicious of any unsolicited message that asks you to log in via a link.