I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading to a fake website (a fake Instagram login page in my case) where the target should enter their credentials (Username and password) so they get relayed to me.
And I am also trying another method, in which the target should click a link that will connect to my server and download a script in the background and execute it, to change the hostname-register on the PC and to connect to another server to do a reverse-shell-attack.
Both of these links don't look legit. I mean one is a bunch of numbers, seemingly random keywords and ends on ngrok and the other one is a bunch of numbers separated with dots (an IPv4 address). Nothing that looks trustworthy at all.
How can I make these links look more like for example "instagram.com" or "security.google.de" or whatever? Is there a method to display it differently in a mail (to basically hide the suspicious link behind a 'nice' one?)
And how do I display something trusty looking in the URL bar of the targets browser, so the fake Instagram pages URL doesn't shout "iAmAViRuS!!11!" to the target? Is it even possible?