Currently, there is this “Fake Instagram website” scam which is going on a lot on Instagram right now. I decided to do some experiments and have concluded about how it works.
TL;DR: It is a fake website that looks like Instagram's login page but it is fake and is used to steal the username and password of victims.
A few months ago, scammers would create accounts with the scam website link in the bio. Then, they would create a post saying something like "You have been added to the nasty list. View the list at the link in bio." But then they need to get views. So they use a spambot that would find random Instagram users and then ping them in the comments. That way, they get at least hundreds of views and they hope victims would fall for it and actually enter their real login details in the fake website. So then I created this http://scammer.info/d/17975-fake-login-scam-website-smasher
Here is a screenshot of an example of a scammer account. The posts would contain comments that are pinging random Instagram usernames.
Well, that account got banned pretty shortly after.
Now, they are not using this method to gain views anymore. Since they have gained login details of enough victims, they would log in to the victims' accounts and message the victims' friends a link to the scam site, which would make it look more legit (hoping that the victims' friends would think the message is actually from their friend, but it is actually from a scammer). Often, the message would be something like "I just saw your account on this list. This is so messed up, so I decided to let you know. You have already been upvoted to #20. You can view it at hxxp://scamwebsite.site" Fortunately, a lot of people are aware of this scam, and know that if they receive a message like that from a friend's account, it is actually from a hacker.
This is an example of a message from a scammer sent to me with my friend's account (who was unfortunately a victim of this scam)
I decided to do some experimentation. So I created a fake throwaway Instagram account for testing purposes. I then had a couple of my friends follow this account (yes, they know that it is for the purpose of this experiment) to make it look like a real account. Lastly, I gave my real username and password to one of those scam sites. Then what happened? Sure enough, the scammers used the account to send the scam message to every follower.
Now, what are scammers really trying to do with the login details? I'm actually not sure. Maybe they want to sell the information to other scammers? If someone here thinks they know what scammers are really trying to do, please share your thoughts.