Instagram Phishing Page — Educational Demo

A pixel-perfect Instagram login clone built for cybersecurity education.
Demonstrates how attackers replicate real login pages using CDN image hotlinks and credential harvesting techniques.

---

⚠️ Disclaimer

This project is strictly for educational and authorized security research purposes only.

The creator of this project does NOT condone, support, or take any liability for the misuse of this tool. Using this tool against any individual or organization without explicit written consent is illegal and punishable by law under various cybercrime statutes worldwide (including but not limited to the Computer Fraud and Abuse Act, IT Act 2000, GDPR, etc.).

By using this software, you agree that you are solely responsible for your actions.

The author provides this project to help security professionals, students, and ethical hackers understand phishing attack vectors so they can build better defenses.

---

🎯 What This Demonstrates

This project is a practical demonstration of how phishing attacks work in the real world. It covers:

Concept	What You'll Learn
CDN Image Hotlinking	How attackers use Instagram's own CDN (static.cdninstagram.com) to serve legitimate-looking icons, fonts, and images — making the clone visually indistinguishable from the real site
Credential Harvesting	How a simple Flask backend captures POST form data (username + password) and logs it to disk
Victim Redirection	How phishing pages redirect victims to the real login page after harvesting credentials, reducing suspicion
Admin Panel	How attackers monitor captured data in real-time through a dashboard
Dark Mode UI	How Instagram's actual CSS variables and design tokens are replicated to match the production UI

---

🏗️ Project Structure

instagram-phishing-demo/
├── app.py                  # Flask server — handles routes and credential logging
├── templates/
│   ├── index.html          # Pixel-perfect Instagram login page clone
│   └── admin.html          # Admin dashboard to view captured credentials
├── requirements.txt        # Python dependencies
├── .gitignore
├── LICENSE
└── README.md

---

🚀 Quick Start

Prerequisites

• Python 3.7+
• pip

Installation

# Clone the repository
git clone https://github.com/ethicalcodnoz/instagram-phishing-demo.git
cd instagram-phishing-demo

# Install dependencies
pip install -r requirements.txt

# Start the server
python app.py

The server starts on http://localhost:8080

Route	Description
/	Fake Instagram login page
/admin	Admin dashboard — view captured credentials
/admin/clear	Clear all logged data

---

🔍 How It Works — Technical Breakdown

1. Frontend — The Phishing Page

The index.html is a direct copy of Instagram's actual login page source. Key observations:

• All images and CSS are loaded from Instagram's CDN (static.cdninstagram.com) — no local assets needed
• CSS variables like --ig-primary-background, --ig-primary-text, etc. are Instagram's actual design tokens
• The page uses Instagram's exact class names (e.g., x1i10hfl, xjbqb8w) from their production build
• Form action is modified to point to the local /login endpoint instead of Instagram's servers

2. Backend — Credential Capture

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username', '')
    password = request.form.get('password', '')
    # Log to file with timestamp, IP, and user-agent
    # Then redirect to real Instagram to avoid suspicion
    return redirect("https://www.instagram.com/accounts/login/")

3. Post-Capture — The Redirect

After credentials are harvested, the victim is immediately redirected to instagram.com/accounts/login/. From their perspective, it looks like the login just failed — they'll try again on the real page and succeed. Most victims never realize what happened.

---

🛡️ How to Defend Against This

If you're here to learn how to protect yourself and others, here's what works:

1. Always check the URL — Look for instagram.com in the address bar, not a random domain
2. Enable 2FA — Even if credentials are phished, 2FA blocks unauthorized access
3. Use a password manager — They won't autofill on phishing domains
4. Look for HTTPS — Though attackers can get certs too, lack of HTTPS is a red flag
5. Don't click suspicious links — Especially in DMs, emails, or SMS
6. Report phishing — Use Instagram's built-in reporting and forward to phish@instagram.com

---

📸 Screenshots

Run the project locally to see the pixel-perfect clone in action.

---

🤝 Contributing

Contributions that improve the educational value of this project are welcome:

• Adding more defense documentation
• Improving code comments for learning
• Adding detection signatures
• Writing companion blog posts

---

📜 License

This project is licensed under the MIT License. See the LICENSE file for details.

---

👤 Author

@ethicalcodnoz — 17yo developer, ethical hacker, cybersecurity enthusiast.

---

⭐ Star this repo if it helped you understand phishing attacks better.
_{Knowledge is the best defense.}