Post cover image

October 14, 2026

Pivoting From a Single Domain to 36: A WhatsApp GhostPairing Investigation

TL;DR

By Frostbyte

2 min read

  • 36 domains served the same phishing kit (file names integrated, theme and login path zomia , same favicon shared between multiple domains) or loaded its files from a kit host.
  • The kit pretends to be an online voting contest (dance, ballet, "photo of the year"). Clicking vote leads to a phone-number form, then to a WhatsApp pairing code the victim is told to enter in their own app.
  • The technique used is called GhostPairing: the victim is tricked into linking their own WhatsApp accoun to the attacker's browser.
  • Lure pages detected are written in Italian, German, Albanian, Serbian/Croatian, Romanian, Slovak, Italian and English;

What is Ghostpairing and why is danger

GhostPairing is an account takeover in which the victim is tricked into completing WhatsApp's own device-pairing flow, adding the attacker's browser as an extra linked device. No password is stolen and no SIM is swapped: the user approves the attacker by entering a pairing code that looks like a normal verification

The phishing page forwards the victim's phone number to WhatsApp's legitimate link device via phone number feature and shows the victim the resulting code, which the victim then types into WhatsApp.

  • Nothing is exploited and no credential is stolen. The owner approves the device with a valid code.
  • The linked device can read synced history, receive new messages in real time and download media.
  • The victim's phone keeps working normally, and linked devices stay active until they are removed by hand.
  • A compromised account can send the lure to its contacts and groups, so the attack spreads through trusted relationships.
  • Captured voice notes and photos can be reused for impersonation, deepfake scams or extortion.

Investigation timeline

The seed was hxxps://leveldance[.]eu[.]cc/home/dancerit, an Italian "Foto dell'anno" voting page. The file hashes and url paths detected on that page have been used to pivot on other urls containing the same file hashes recursively and repeating the process on every new domain found while dropping too broad indicators.

A urlscan.io result of elitefighters[.]pro/home/ita2 dated 3 Apr 2025, outside the 90-day search window, serves the same integrated.css, integrated.js v1 and modified sweetalert2.js. It was added to the case file and is the oldest sighting of the kit.

None None

From the title reported in the page it was possible to split the domains into 7 language clusters, meaning that the campaign is ongoing in multiple countries:

  • German: 20 URLs: "Foto des Jahres", "Anmeldung","Kinder-ballet"
  • English: 8 URLs: "Competitions 2026", "Photo of the year"
  • Albanian: "Garat 2026", "Autorizimi"
  • Serbian / Croatian: 5 URLs: "Takmičenja 2026", "Fotografija godine", "Finalisti iz Srbije"
  • Italian: 4 URLs: "Foto dell'anno", "Il vot2"
  • Romanian: 1 URL, "Fotografia anului"
  • Slovak: 1 URL, "Fotografia roka"

Domains detected, detection time on urlscan.io

elitefighters[.]pro, 2025–04–03

dancevote[.]pro, 2026–07–13

msdancing[.]site, 2026–07–15

balletfests[.]top, 2026–07–17

starsgirls[.]top, 2026–07–17

votematch[.]top, 2026–07–20

megadencer[.]top, 2026–07–22

champios[.]top, 2026–07–24

kidenfriow01[.]shop, 2026–07–25

balletfest[.]top, 2026–07–27

missdance[.]top, 2026–07–28

one-danser[.]top, 2026–07–29

smalldancer[.]top, 2026–08–03

www[.]worldballetcompetition[.]pro, 2026–08–05

batelldanser[.]top, 2026–08–06

girlsvottes[.]top, 2026–09–02

best-champ[.]top, 2026–09–08

dancerfest[.]icu, 2026–09–09

star-champ[.]club, 2026–09–15

champ-girl[.]biz[.]id, 2026–09–18

star-voted[.]eu[.]cc, 2026–09–18

girlstar[.]eu[.]cc, 2026–09–21

girlstar[.]my[.]id, 2026–09–22

starr-dancer[.]my[.]id, 2026–09–23

chico-dance[.]buzz, 2026–09–24

flydancer[.]eu[.]cc, 2026–09–24

fesst-dancer[.]eu[.]cc, 2026–09–25

fest-dancer[.]eu[.]cc, 2026–09–25

dancerglobal[.]eu[.]cc, 2026–09–27

flygirl[.]eu[.]cc, 2026–09–30

ultradencer[.]biz[.]id, 2026–09–30

ultradencer[.]eu[.]cc, 2026–09–30

girlsdancer[.]eu[.]cc, 2026–10–03

slovakgirl[.]eu[.]cc, 2026–10–03

leveldance[.]eu[.]cc, 2026–10–05

itali-dancer[.]eu[.]cc, 2026–10–07

File Hashes

20e9c16713edf2f62880b40500895077a27188ef4096868ecf45bb10a773ac2c | logo.png v1 | /static/integrated/logo.png

1e2c817caddaf3c76032e874ddda1dec9ec74e3ab28d6dfbd61b0c41ec8136e5 | sweetalert2.js | /static/js/lib/sweetalert2.js

376319b9951c9cfb9be7eff371ef017326c1900fceced1381d310c934f5a1d5c | integrated.css | /static/css/integrated.css

053839a272324f4810a7731961fcb75bfe3e2f54561f7415a488b06f5bb761bb | background.jpg | /assets/img/themes/zomia/background.jpg,

9a862b97e104af0270010a0fe9343f418f60e2ac269c3d32cdf22742c329feda | integrated.js | /static/js/integrated.js

f5a14cb2ee6423855ebc6887775abbce924298660d55fe76ad9d0e119b9063e7 | integrated.js | /static/js/integrated.js

61e663ebc5b48dbc84ef4997684f0b1d6394d7f364a1f84fd4294ece2ecf8b1a | 66c8e98f7171.png | /static/uploads/66c8e98f7171.png

56ff8e0a3c2d9bd53417fa17159bc95e6d035555bcedea05b12edb41e182d8d5 | 50ddf2ddd332.png | /static/uploads/50ddf2ddd332.png

aacbbe15261df51f38ba8f9c9d0c9442e2818723aafb4476ee0d8a99f9be6e2d | 58af927498cc.png | /static/uploads/58af927498cc.png

6d25b634b247df28ee9561367064a58c56aa860c51b2d0117e3d2fbda805af96 | 7ce23eedbb06.png | /static/uploads/7ce23eedbb06.png

f0193b29f96fc71f8b357a27f42c741f579709f6b91e87e24cfd6c3b7948a061 | 6b3585631ea4.png | /static/uploads/6b3585631ea4.png

Urls detected

hxxps://elitefighters[.]pro/home/ita2 hxxps://dancevote[.]pro/home/eng8 hxxps://msdancing[.]site/home/eng5 hxxps://balletfests[.]top/home/eng77 hxxps://starsgirls[.]top/home/eng9 hxxps://dopvster7[.]shop/home/toorent hxxps://kidenfriow01[.]shop/home/votmeo hxxps://star-champ[.]club/home/votedb hxxps://star-champ[.]club/login/zomiadeb hxxps://champ-girl[.]biz[.]id/home/votedb hxxps://star-voted[.]eu[.]cc/home/votehr5 hxxps://girlstar[.]eu[.]cc/home/stardeb hxxps://girlstar[.]my[.]id/home/starde10 hxxps://starr-dancer[.]my[.]id/home/stardeb hxxps://chico-dance[.]buzz/home/stardeb hxxps://flydancer[.]eu[.]cc/home/stardeb hxxps://fesst-dancer[.]eu[.]cc/home/stardeb hxxps://fest-dancer[.]eu[.]cc/home/stardeb hxxps://dancerglobal[.]eu[.]cc/home/stardeb hxxps://flygirl[.]eu[.]cc/home/dencede hxxps://ultradencer[.]eu[.]cc/home/dencereng hxxps://ultradencer[.]biz[.]id/home/dencerro8 hxxps://girlsdancer[.]eu[.]cc/home/dancerit hxxps://slovakgirl[.]eu[.]cc/home/dencesk hxxps://leveldance[.]eu[.]cc/home/dancerit hxxps://itali-dancer[.]eu[.]cc/home/dancerit

hxxps://balletfest[.]top/home/voteal1 hxxps://balletfest[.]top/home/voteal8 hxxps://balletfest[.]top/home/votegr4 hxxps://balletfest[.]top/home/voteme8 hxxps://balletfest[.]top/login/zomiagr4 hxxps://batelldanser[.]top/home/vote4ch hxxps://batelldanser[.]top/home/vote8ch hxxps://best-champ[.]top/home/voted1 hxxps://champios[.]top/home/eng3 hxxps://dancerfest[.]icu/home/voted1 hxxps://girlsvottes[.]top/login/zomias1 hxxps://megadencer[.]top/home/eng3 hxxps://missdance[.]top/home/voteal1 hxxps://missdance[.]top/home/voteme8 hxxps://one-danser[.]top/home/voteal4 hxxps://one-danser[.]top/login/zomiaal4 hxxps://smalldancer[.]top/home/vote3ch hxxps://smalldancer[.]top/home/votegr4 hxxps://votematch[.]top/home/eng8 hxxps://votematch[.]top/home/star8

hxxps://www[.]worldballetcompetition[.]pro/AnnaVsSofia