How to phish someone without getting caught?

[rx10]

Right so I am doing this for a (pretty) valid reason. My friend that I have known for quite a while has been sexually abused by a person I also know (and I'm pretty sure it's true because that guy is an absolutely massive pervert). I told her to report him to the police but for some stupid reason she said no because it could ruin his life. I can't report it myself to the police for the obvious reason.

Right so I want to get revenge myself and hopefully even get some more evidence that this guy is a psycho. I was thinking of sending him an email saying that there has been suspicious behaviour on his Instagram(say a random IP and location that be never went to) and that he needs to log in on the following link to disable all the other devices located in USA. Then if he doesn't login on that website I will call him and try to act like I'm working at instagram land-line and that he needs to login (put towel over the phone so my voice doesn't sound like usual. Will this work? Also hide caller id). He's not really smart but not dumb and he is OK at computers (when I say ok I mean that he only knows the basic stuff but not too much, he's not interested in IT).
What hostshould I use? Should I buy a domain for a short time to make it look more trustable? He doesn't know much about encryption and SSL either so I don't think he will notice that
Which host should I use and should I buy a domain for a short time? How do I avoid getting myself caught?

[iTpHo3NiX]

Set up the phish site on some free TOR host and use a TOR to web service and mask the link with a URL shortener that you would find on Instagram. Use a mail spoofer to appear as Instagram, however this may get flagged by Google, so that's a little more tricky

[Dr4g0n]

Right so I am doing this for a (pretty) valid reason. My friend that I have known for quite a while has been sexually abused by a person I also know

You need to treat this how it is, a crime, so plan this out as if you were about to rob him or beat him with a baseball bat. You know him, which makes this dangerous, and as long as you have hopefully followed the 3 rules of black hat club, which is
1.Shut the fuck up about black hat club
2.Shut the fuck up about black hat club
3.Shut the fuck up about black hat club

You should be fine to hack this bitch. But of course, you told your friend, and my guess is she probably told someone else(maybe even someone that would reach this bitch), if that is true, opsec is going to be risky. You also need to outline your goal, if he a psycho, so what? Are you going to press charges(with evidence you can't use in court because you committed a felony yourself), or ridicule him?(which isn't going to work because if he is actually a psycho or a sociopath, he will think everything is fine because he lacks a precursor to guilt, which is shame and worry). If you just want revenge, how are you going to show it? By straight telling him, "ha ha i haxxed ur shit niqqa x-DDD DD",which will make him remember the email he got and possible report you?

(put towel over the phone so my voice doesn't sound like usual. Will this work? Also hide caller id)

No. It won't work, put a towel over your phone and record it, if you RANDOMLY got this as a call, would you trust that person? If they sound like they are literally talking out of their ass through their pants, would you trust them?
Buying a domain for a short period of time is a bit risky, mainly because it keeps logs on something you can't reach, I would try to self host and maybe spoof it with SET or something, usually that could work on a LAN network, you go to school with him? Maybe even set it up at the girls house if he comes back.

In any case, I don't completely know what is going on, personally I would drop it, I'm not some crusader for good and valiant, but I'm also a dick,you could do some research on reporting abusive relationships since it seems like its gone a bit far.

[rx10]

Set up the phish site on some free TOR host and use a TOR to web service and mask the link with a URL shortener that you would find on Instagram. Use a mail spoofer to appear as Instagram, however this may get flagged by Google, so that's a little more tricky

Right, I found more info about him. He uses an iPhone 4 and spends his time mostly on Facebook. He also very rarely uses his email. Would there be any way to spoof the SMS number?  Any Facebook link shortener?

[Octavius]

Are you trying to gain access to his Facebook or Instagram?

[th31nitiate]

I think he is just trying to fuck his life up for a girl that he love's and maybe she love's him or maybe not who care's.

If your going to do this your a ballize guy, i recommend testing first in what ever environment your going to do it in. So find out who he is who his email service provider is. Get a main target i.e facebook, insta ect. Now start crafting a phishing page make it look good and believable. You will need to do more than  just copy and paste the code you going to need some php somewhere there. Once you got the page, i recommend for a project like this that you just use a basic offshore vps should be fine since your only targeting one person and you buy your domain from a different offshore company in a different region make sure you privatize the whois. Once you have this your are pretty much good to go set up everything so it working fine ect.

Now you start crafting the link and email you will use trick him, when you create the link you can put it inside a hyper link with something like click here and also when you are spoofing smtp by editing the source headers you will need to test it with his email service provider by creating an account with them and sending you self the same email. When you buy the domain make sure you make it long and complicate, like a dynamically generated link. If the test's pass then you are all good to go

DONT CALL HIM, if he dont fall for it try something else like different service or try get him to register on to something that you create example (FREE PS7 sign up now or find sexy single's in your area now) but you have to tailor it to him, the aim of the game is to get one password, likely hood is the guy has the same password for everything. If you get access to him email you have access to the rest pretty much, because you can reset password via email.

Ohh and with the domain you can also use TOR like itphonix mentioned "TOR to web service and mask the link with a URL shortener"

This in all in theory so i am not sure if it will but it seems logical to me plus the test phase will save you

[Diemecry]

Right, I found more info about him. He uses an iPhone 4 and spends his time mostly on Facebook. He also very rarely uses his email. Would there be any way to spoof the SMS number?  Any Facebook link shortener?

I don't really understand How is getting his password to his insta or FB going to give you what you need to get reveng?
Did he make her send nudes becasue if he did all you would have to do is call the cops saying he has kid porn on his phone
and if its not pics and he forced himself on her you can basicly do the same thing
I dont really see why you have to hack him to get pay

[b00ms1ang]

Don't get cocky. If you're still green to all this and you mess up, batta bing you're busted. If she didnt report him for sexual assault, and you get caught hacking... guess what? You're the only one committing a crime by the standards of the law (God bless America).

Test everything. I'd say go with a TOR host, but know the second you have TOR you are a target. But that's really the only way you'll get this done quickly. And be patient, you have a lot more work to do than you think. Patience is key, watch and wait.

[queryFrequency]

When puddi was assaulted by his dad, this is what he paid me to do. I kidnapped him, placed him at the basement of a bar, tied him up. There was my job done, just kidnap him, but I wanted to stay just for the excitement. Puddi came down with dramatic music playing in the background with shining light behind him, had the face of a man who had just had a dildo shoved up his ass for 8 hours and wanted revenge. He gave this gay inspirational speech about the effect it had from his abuse, blah blah blah is what I mostly heard. Anyways, he then poured acid onto his toes, real slow right. When he screamed, puddi turned his face around to me, in slow motion, gave me a smile, I flipped him off. He then forced bleach into his mouth after 1 hour of acid being dripped everywhere on his body. So, just do that to your abuser instead of your phishing shit.

Simple if you ask me.

[dec]

Then if he doesn't login on that website I will call him and try to act like I'm working at instagram land-line and that he needs to login (put towel over the phone so my voice doesn't sound like usual. Will this work? Also hide caller id)

Pay for a burner phone. Then use ivona to talk to him.  https://www.ivona.com/

Thats at least what I'd do.

[Devildweep]

Like many people have said before the phishing ain't really going to get you anywhere unless you intend to turn this guy in.
Getting the gist of this situation it's idiotic, if the girl saying she doesn't want turn in someone who is molesting her it probably means she loves him or something on those lines.I don't really know if you doing this out sense of justice. or something but clearly you understand the end result to the phish holds no value because your not going to turn the guy in. Simply dude your wasting your time, money,effort.
Don't stand in the middle ground either leave this friend to their fate or tell the cops.
One of my friends had this happening to her, a similar situation she couldn't tell the cops cause she loved him. Well I told the cops. Yes she stopped talking to me for a while but after she understood she came back.
Your friends blind right now, she probably doesn't understand what's going on and what effects it could have on her psychology. If you really care for her make the right decision man.

I know my answer is not much hacking related on the lines of what you want, but honestly you don't want to be behind bars for something as lousy as this and in the end I don't really know the entire situation from your point of view that's why this is an opinion of what I feel the situation might be based on what you said, it could be a completely wrong guess.

Sent from my HTC_0PFJ50 using Tapatalk