All of this happened on 18th November 2020

A person I know sent me a phishing link of Facebook then Google, I entered my credentials however as soon as I found out that its a phishing link, I turned off my mobile WiFi and switched it off and I changed my Google Password immediately from another device which was my iPad, I didn't change my Facebook password because it didn't have any information of myself at all, but somehow he got to know my Instagram tag which he claimed to have got to know through Facebook but I never linked it, It just had the same email as my Instagram, so the only way he could've got to know my Instagram is if he had my Gmail account.

I downloaded the Google Data of my account and checked the login history of my account It didn't show any other IP addresses or other devices rather than mine, there were 4 forgot passwords made on my Instagram which I got through the mail but when I checked my Instagram logins there wasn't any other login either (other than my devices and IP addresses) and my Gmail didn't have less secure app access turned on

When I booted my Mobile Phone again, the one where I opened the phishing link, I downloaded Bitdefender security and scanned my device and it didn't find any malware. The browser I used was a Hidden Calculator Browser, the guy who phished claimed that he used Social Engineering Toolkit first when he phished for Facebook and it didn't work so he tried phishing Google using HiddenEye and it worked.

I did an Nmap scan on my PC and it found an open port number 4445 named upnotifyp but this was only internal because when I told my friend to scan there was no open port on my IP address and I downloaded Avast WiFi inspector on my PC scanned my WiFi and Router and it said no vulnerabilities detected.

I'm having severe anxiety for weeks because my Google Photos had sensitive pics that were supposed to be my eyes only but I don't know whether he logged in or not because there was no IP address or device other than mine in Google Login History but he got to know my Instagram tag when it wasn't linked to Facebook, but he claimed to get it through Facebook, my Facebook and Insta only shared the same email ID and there's no other way he could've got to know my Insta other than having access to my mail, but then again there were no other IP addresses and I can guarantee that this person wasn't using my WiFi, please help me out.

  • I believe you can use your google login to login to Facebook. Maybe that explains part of it, and since instagram is owned by Facebook, I'm sure a google or Facebook login session is enough for it too. Commented Feb 17, 2021 at 20:04

2 Answers 2


The number of answers to this question is infinite. You will achieve peace of mind by cutting contact with this person, changing all of your credentials, enabling 2FA, and checking any logs that these services provide you.

Here are some ways he could have linked them:

  1. Since Facebook and Meta are owned by the same company, he could have exploited some unknown piece of data that Facebook leaks, that can quickly be used to find your instagram as well. (Some ID).

  2. He could have simply looked at your friends list, quickly downloaded all of their names, and then found them all on Instagram, and then checking who they follow and who follows them, until they found you. I guarantee there is at least one person on your FB friends list who you're also connected with on Instagram, who has a public Instagram.

  3. He could have gotten your phone number from your Facebook, added it to the contacts on his phone, which Instagram often uses to show "Recommended" accounts to follow. Snapchat for example, will gladly show you the Snapshat usernames of anyone who's phone number you have. In fact, he could have gotten your Snapchat username using your phone number (if you have one), and then used that to find your Instagram. Many other apps may have leaked a username if he had your phone number.

  4. He could have downloaded all of your Facebook images, including private ones, and reverse image searched them until he found them on a website that scrapes Instagram accounts, either by matching your Instagram profile picture, or one of the profile pictures that some bot scraped 5 years ago when you made your Instagram public for one day accidentally.

Again, the list is infinite.


Mapping someone out on the internet is possible with OSINT. They would have used OSINT tools to find the various social media connections your gmail id would have. It's pretty interesting how much you can find out about someone with just an id or a full name.

And with respect to your phising, it's always important to be very cautious while opening links, always check the site address carefully the link is taking you to.

  • Yes but is there any other way he could’ve got in, I changed my gmail password and there were no other IP address or devices in my login history, could he access the information somehow?
    – yessirmk
    Commented Jan 20, 2021 at 12:07
  • @yessirmk if you don't have any ip logs, then there's not much to worry about. Change your password and enable 2 factor authentication on all your accounts and you should be fine.
    – Gamzosh
    Commented Jan 20, 2021 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .