web.mis-ws.org looks broken on a computer: 153 bytes of nothing. On a phone it opens a polished 「WhatsApp 安全檢測中心」support chat that walks you through a security check. The check is real — it is WhatsApp's own Link a device flow. The only lie is whose device is being linked. The victim performs the account takeover themselves, with their own thumb, and thanks the operator for helping.
The kit is a fake support desk wrapped around a real WhatsApp linked-device pairing session. It asks for your number, WhatsApp sends its session an 8-digit code, the chat hands you that code, and you type it into your own phone — which authorises the operator's server as a device on your account.
The server 404s every desktop user-agent, and the head script drops anything matching
bot|spider|crawl|headlesschrome|phantomjs|selenium|puppeteer|playwright|curl/|wget.
A second gate (mgate.js) then checks platform, WebGL renderer and
userAgentData.mobile. The reason is not mobile UX — your WhatsApp has to be on the
device you are holding.
A 「客服安全驗證」screen, then a bot pretending to be WhatsApp's security centre. The pretext is deliberately vague — order, delivery, refund — so any visitor can project their own half-finished transaction onto it. The menu offers 查詢訂單 / 物流配送 / 退款售後 / 人工專員; every branch ends in the same place.
A card appears: 驗證手機號碼 — "enter your phone number, we'll send you a link request", with a country picker defaulting to +86. No password, no OTP entry field of the usual shape. The number is what opens a pairing session on the operator's side.
WhatsApp answers with a real pairing code. In the genuine flow that code is entered on the phone; that is exactly what the kit tells you to do — and the instruction it gives is accurate. Open WhatsApp → 設定 → 關聯設備 → 使用電話號碼關聯 → type the code below. The victim authorises the operator's session while believing they are verifying their own account.
On success the chat does not celebrate — it manufactures a review process. "AI 檢測已完成" becomes "manual review", and one line tells you the whole operation: do not remove the device you just linked. Removing it would cut the operator off, so the script reframes removal as the thing that gets you banned.
「正在為您接入人工安全專員」 is not decoration: the bot script is local, but from here every
message goes over /session/message and comes back from /session/poll, with
typing indicators and image upload. A real operator keeps the victim talking, harvests order and
refund details, and guards the linked device — while the account is already open to them.
Nothing in this chain is a WhatsApp vulnerability. Every step is a supported feature, aimed at a human instead of a machine — which is why the kit spends its engineering budget on trust theatre, not on exploits.
The gate has one exception: /q/<6–16 chars> is allowed through unconditionally,
because that page has to open on a desktop. The kit creates one per victim with a
120-second expiry — long enough to scan, too short to report or reshare.
The backend relays WhatsApp's real failure reasons — login_rejected,
device_limit, login_timeout — then offers "scan the QR instead". Both
paths end the same way: the operator holds a linked device.
llFco8/ is byte-for-byte as served
(1.19 MB app, CSS, 13 illustrations, gate + loader chunks). One addition: guard.js,
which makes the kit's own mobile gate pass so it can render here, and hard-blocks every network call.
The archive cannot reach the operator's backend and cannot be used as a working kit.The capture is the real first screen: the 「客服安全驗證」gate, the bot's risk warning, the service menu and the 開始驗證 button. Type nothing — the phone form is where stage 3 begins, and in the archive it cannot submit anywhere.
Best viewed phone-width. The archive is a historical record — the live domain rotates its entry chunk and will look different, or be gone.
| Item | Value |
|---|---|
| Host | web.mis-ws.org · apex mis-ws.org (no A record) |
| Registered | 2026-10-12 · Gname.com · NS a.share-dns.com / b.share-dns.net |
| Edge | → 9dae60af.a1vk0eiqz0.xyz → cdn.a1vk0eiqz0.xyz |
| Addresses | 45.61.163.20 · 45.61.150.6 · 45.59.119.120 · 144.172.98.253 · 144.172.102.144 · 172.86.90.167 |
| Assets | /llFco8/ — rotating entry chunk, 1.19 MB app, 13 .webp illustrations |
| API | /api/allocate · /api/pc-scan/<code> · /api/tg-cs/session/{health,access-check} · WS /api/v1/ws1 |
| Support desk | /session · /session/message · /session/poll · /session/typing · /session/media |
| Storage keys | kf-wa-pairing-session · kf-wa-ws-path · kf-human-verification-passed |
| Analytics | Umami · website-id 1e2159ad-6f45-474d-9533-3ca58be064e1 |
| Locales | zh-CN · zh-HK · zh-TW · en — auto-selected from .hk/.mo/.tw hosts |