kit
BellaMain
An operator-developed PHP phishing-as-a-service panel with brand-impersonation kits. Named by 2 reports, 4 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: BellaMain PhaaS panel. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
BellaMain Turkish PhaaS Panel (79.137.192.3)
TOOLKIT_BellaMain_WadanzFunctions, TOOLKIT_BellaMain_AdminPanel, TOOLKIT_BellaMain_AntiResearcherCanary
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-008: Developer and operator of the BellaMain Turkish phishing-as-a-service panel
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.