0

All of this happened on 18th November 2020

A person I know sent me a phishing link of Facebook then Google, I entered my credentials however as soon as I found out that its a phishing link, I turned off my mobile WiFi and switched it off and I changed my Google Password immediately from another device which was my iPad, I didn't change my Facebook password because it didn't have any information of myself at all, but somehow he got to know my Instagram tag which he claimed to have got to know through Facebook but I never linked it, It just had the same email as my Instagram, so the only way he could've got to know my Instagram is if he had my Gmail account.

I downloaded the Google Data of my account and checked the login history of my account It didn't show any other IP addresses or other devices rather than mine, there were 4 forgot passwords made on my Instagram which I got through the mail but when I checked my Instagram logins there wasn't any other login either (other than my devices and IP addresses) and my Gmail didn't have less secure app access turned on

When I booted my Mobile Phone again, the one where I opened the phishing link, I downloaded Bitdefender security and scanned my device and it didn't find any malware. The browser I used was a Hidden Calculator Browser, the guy who phished claimed that he used Social Engineering Toolkit first when he phished for Facebook and it didn't work so he tried phishing Google using HiddenEye and it worked.

I did an Nmap scan on my PC and it found an open port number 4445 named upnotifyp but this was only internal because when I told my friend to scan there was no open port on my IP address and I downloaded Avast WiFi inspector on my PC scanned my WiFi and Router and it said no vulnerabilities detected.

I'm having severe anxiety for weeks because my Google Photos had sensitive pics that were supposed to be my eyes only but I don't know whether he logged in or not because there was no IP address or device other than mine in Google Login History but he got to know my Instagram tag when it wasn't linked to Facebook, but he claimed to get it through Facebook, my Facebook and Insta only shared the same email ID and there's no other way he could've got to know my Insta other than having access to my mail, but then again there were no other IP addresses and I can guarantee that this person wasn't using my WiFi, please help me out.

1
  • I believe you can use your google login to login to Facebook. Maybe that explains part of it, and since instagram is owned by Facebook, I'm sure a google or Facebook login session is enough for it too. – pcalkins Feb 17 at 20:04
0

Mapping someone out on the internet is possible with OSINT. They would have used OSINT tools to find the various social media connections your gmail id would have. It's pretty interesting how much you can find out about someone with just an id or a full name.

And with respect to your phising, it's always important to be very cautious while opening links, always check the site address carefully the link is taking you to.

2
  • Yes but is there any other way he could’ve got in, I changed my gmail password and there were no other IP address or devices in my login history, could he access the information somehow? – yessirmk Jan 20 at 12:07
  • @yessirmk if you don't have any ip logs, then there's not much to worry about. Change your password and enable 2 factor authentication on all your accounts and you should be fine. – Gamzosh Jan 20 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.