Instagram Giveaway Scam Report
Scam Setup
Platform: Instagram Story (from compromised friend's account)
Offer: "$5,000 Cash Giveaway" from "Instagram Official"
Requirements: "Verify account" via external link
Urgency: "Limited to first 100 participants"
Attack Vector
Initial Interaction
- Friend's account posted story about giveaway
- Link led to instagram-verify-giveaway.com
- Professional-looking page with Instagram branding
- Requested login credentials "to verify account eligibility"
Technical Analysis
- Domain: Registered 4 days prior, privacy protection enabled
- SSL: Let's Encrypt certificate (legitimate, adds false credibility)
- Hosting: US-based VPS, likely compromised server
- Post-Compromise: Credentials sent to Telegram bot, then to attacker
What Happened After Login Attempt
- Immediate:
- Page showed "Verifying..." for 30 seconds
- Then redirected to real Instagram login page
- No error message (designed to not raise suspicion)
- Attack Sequence (based on other reports):
- Credentials used within minutes to access account
- Password change requested
- Same scam posted from compromised account
- 2FA bypass attempted via SMS phishing
Protective Actions
- Immediate Response:
- Realized mistake, didn't complete login
- Changed Instagram password immediately
- Enabled 2FA (authenticator app, not SMS)
- Checked login activity (no unauthorized access)
- Reporting:
- Reported phishing site to Google Safe Browsing
- Notified friend about compromised account
- Reported to Instagram
- Filed with Quiet-Report platform
Impact
Accounts Protected: Own account + warned 12 friends
Compromised Accounts: Friend's account hijacked for 6 hours
Financial Loss: $0 (prevented)
Time Invested: 3 hours (recovery + reporting)
Technical Indicators
- Phishing kit: "InstaPhish v2.1" (known tool)
- C2: Telegram bot @insta_verify_bot (suspended)
- IP range: 104.21.45.* (Cloudflare proxy)
Recommendations
- Never login to social media via third-party sites
- Use unique passwords for each platform
- Enable app-based 2FA, avoid SMS
- Verify unusual posts directly with friend
- Report suspicious activity immediately