Skip to content
THE HUNTER’S LEDGER
IOC Feed
BellaMain Turkish PhaaS Panel (79.137.192.3)
35 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
35 shown
TypeIndicatorConfidenceActionFP risk
ipv4 79.137.192.3DEFINITEBLOCK
domain bellamain.zipDEFINITE
domain cryptone.botHIGHBLOCKLOW (specific operator-controlled domain)
domain evotoptan.comMODERATEMONITORMEDIUM (Namecheap shared hosting hosts many unrelated sites, combine with kit landing-page URL pattern)
url https://79.137.192.3/DEFINITEBLOCK
url https://79.137.192.3/BellaMain/DEFINITEBLOCK
url https://79.137.192.3/cryptone/DEFINITEBLOCK
url https://79.137.192.3/no/DEFINITEBLOCK
url https://api.binance.com/api/v3/ticker/price?symbol=TRXTRYDEFINITEMONITORHIGH, legitimate crypto applications also query Binance API. Detection value is operator-side context.
url https://cryptone.bot/HIGHBLOCK
url https://dolap.com/DEFINITEBLOCK
url https://letgo.com/DEFINITEBLOCK
url https://m.turkcell.com.tr/DEFINITEBLOCK
url https://sahibinden.com/DEFINITEBLOCK
url https://www.pttavm.com/DEFINITEBLOCK
url https://www.shopier.com/DEFINITEBLOCK
url https://www.usom.gov.tr/url-list.txtDEFINITEMONITORHIGH. This is a legitimate Turkish CERT URL; legitimate security tools also fetch it. Detection value is in seeing this fetch FROM a non-Turkish-CERT-affiliated PHP host.
sha256 219cd4f6177a2358ec7f06b230d611f47e1049fcb3e2b44d06ec410b336382b0DEFINITEBLOCK
sha256 2c656360c4e58854dca35ff21b3fc62db41155ca76f8568ecc18fa52aa38fb31DEFINITEBLOCK
sha256 504b1a30ce7060eafa7b2a3f6249c954a0be6ce1d2930e03b030434cb232600aDEFINITEBLOCK
sha256 705793c011fdfe17941700a3bf42eee0ba2ebdc04870ce19779ea528b3565facDEFINITEBLOCK
sha256 b2f4f1617577d14612b30a54a733b15af809c399f325717b4329c13aaa4c915cDEFINITEBLOCK
sha256 e21fb63a3b4d65a3d48dec1bf17a84a414482f819b93cb8d77a81852dc34c95fDEFINITEBLOCK
sha256 ee9d4fccebbf73fb33980da15142bc71e5d9661d1bc583c2b09b77490065efd9DEFINITEBLOCK
sha256 f791fae41cdd3f141221d1783ed4779c839de7fc834ff4fc80a5d7f74b11ff88DEFINITEBLOCK
sha1 bbfb41447fd60907bc529d6cf786827c9ec2a041DEFINITE
md5 7055c03da7660b196cb46426fb7f2986DEFINITE
email hello@cryptone.botHIGHMONITOR
filename dolap.rarDEFINITEBLOCK
filename kargo.rarDEFINITEBLOCK
filename letgo.rarDEFINITEBLOCK
filename pttavm.rarDEFINITEBLOCK
filename sahibinden.rarDEFINITEBLOCK
filename shopier.rarDEFINITEBLOCK
filename turkcell.rarDEFINITEBLOCK

84 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.