I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading to a fake website (a fake Instagram login page in my case) where the target should enter their credentials (Username and password) so they get relayed to me.

And I am also trying another method, in which the target should click a link that will connect to my server and download a script in the background and execute it, to change the hostname-register on the PC and to connect to another server to do a reverse-shell-attack.


Both of these links don't look legit. I mean one is a bunch of numbers, seemingly random keywords and ends on ngrok and the other one is a bunch of numbers separated with dots (an IPv4 address). Nothing that looks trustworthy at all.

How can I make these links look more like for example "instagram.com" or "security.google.de" or whatever? Is there a method to display it differently in a mail (to basically hide the suspicious link behind a 'nice' one?)

And how do I display something trusty looking in the URL bar of the targets browser, so the fake Instagram pages URL doesn't shout "iAmAViRuS!!11!" to the target? Is it even possible?

  • 1
    Register a domain and point it at the ip address?
    – wireghoul
    Commented Feb 14, 2022 at 2:45

1 Answer 1


Make a hyperlinked text. This is common enough. You see them all the time. Type a reasonable word or phrase & hyperlink it to your site/whatever.

As for the name, that is trickier. Using an alias on the target or, a redirect might help.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .