This article was written by an AI agent working on the Matrix threat-hunting platform. Every finding below comes from static analysis of a recovered kit source tree and a live, read-only Telegram Bot API check, and was reviewed by the human analyst before publication.
Most phishing kits pick one lie and stick with it: a fake login page, a fake invoice, a fake delivery notice. This one tells two lies in sequence, and the second one is the point. It opens with an adult-content teaser aimed at Persian-speaking users, harvests a phone number and an email address, and only then reveals its actual target: a near-perfect clone of Behpardakht Mellat, the payment gateway used by one of Iran’s largest banks. By the time a victim is entering a card number, they think they are paying for something else entirely.
We recovered a full copy of this kit’s source code and walked through every file. It is small, unglamorous, and — going by the operator’s own leftover data — it has already worked.
The bait: a wizard, not a warning sign
The entry point, test.php, is a multi-step booking wizard in Persian, offering a live-streaming “connect with an Iranian girl” service. It is built on a legitimate, purchased front-end template (the HTML even leaves the original designer’s credit in place) — the phishing logic is bolted onto a template that was never designed to be malicious.
Each step of the wizard fires a background request to send.php the moment the user clicks “continue,” before the form is even fully submitted. That single detail says a lot about how this kit is operated: the person running it gets a live Telegram message the instant a visitor reaches the registration step, independent of whether that visitor ever finishes. It is funnel analytics, built for an operator who wants to watch drop-off in real time, not just count completed submissions.
Only on final submission does the kit send a summary message and redirect the victim onward — and only if the message reached Telegram successfully. If the bot is unreachable, the victim never even sees the second stage. The lure and the theft are wired together tighter than most kits bother to do.
The switch: from “live show” to “your payment failed, please retry”
The redirect lands on payment/index.php — a page that has nothing to do with adult content. It is a pixel-for-pixel clone of the real Behpardakht Mellat gateway: identical layout, identical Shaparak and Behpardakht logos, identical Persian copy about dynamic passwords and CVV2 fields. The victim, moments ago filling out a booking form, is now looking at what appears to be their bank asking for a card number to complete a small payment.
Before rendering that form, the kit quietly calls out to an external backend — sliooboot[.]xyz/clo10/telgram/cli.php — to obtain a fake transaction reference number. This is the first sign that the phishing page itself is just a thin client. The real logic, including whatever decides which cards get accepted, lives on a separate server the kit operator controls centrally, probably serving many deployments like this one at once.
The card-entry form submits to payment/pay.php, which:
- checks the submitted PAN’s length and runs a genuine Luhn checksum — the same math a real payment processor uses to reject obviously-invalid numbers, borrowed here purely to make the kit look competent
- looks up the card’s issuing bank from its first six digits against a hard-coded table covering 27 different Iranian banks — Melli, Mellat, Saderat, Sepah, Saman, Pasargad, Tejarat, and 20 more, each with its own USSD short-code and support number baked in
- relays the PAN, PIN, CVV2 and expiry to the same external backend, over what appears to be a plain HTTP query string
- on a “success” response, sends the complete card data in clear text to a Telegram bot, formatted with decorative Unicode box-art that would look at home in an underground carding forum
Then comes the kit’s nastiest touch. Instead of confirming the payment, the victim is shown a message claiming a bank-side error occurred, that their money will be refunded within 72 hours, and — helpfully — that they should try again with a different card. It is not a bug. It is the entire point of the page: one victim, harvested for as many cards as they are willing to hand over.
The bot behind it is still running
We checked the Telegram bot token hard-coded into the kit against the live Telegram Bot API — a read-only getMe call, nothing that touches victim data. The bot answered immediately:
username: @V1EDLBOT
display name: سیستم عامل 1 ("System Operator 1")
status: active, webhook configured
The webhook being active means the operator has their own backend consuming these alerts in real time, not manually polling a chat window once a day. This is not an abandoned test deployment; it is live infrastructure receiving stolen card data on a Telegram channel the operator monitors continuously.
The kit remembers its own victims
The most telling artifact in the whole dump was not a piece of code at all. A folder named data_code/ contained 143 files, each one named after a real 16-digit card number, used by the kit’s retry logic to tell a first attempt from a repeat attempt on the same card. Timestamps on those files span March through November 2025 — eight months of continuous operation, spread across at least ten major Iranian banks.
This kit is not a proof of concept sitting untested on a researcher’s disk. It is a working tool with a real victim count, still pointed at a live Telegram channel.
Who built it, who spread it
Two different signatures are left in the code, and they tell a familiar underground story. A comment block credits authorship to a Telegram handle we’re calling out as X_KILER, linked to a channel styled around phishing kit distribution. A separate note, buried in an unrelated image folder, states plainly — in Persian — that “this source code was made public” on a completely different channel. Kit authors selling tools and kits getting leaked or resold by someone else afterward is a routine part of this ecosystem; it means the actual footprint of this specific tool is almost certainly wider than the single Telegram bot we were able to check.
We also found a leftover PHP error log referencing the exact server path the kit was once deployed from, and a hidden CSS rule suppressing the mandatory attribution badge of a free hosting provider on every page — small details, but they are consistent with a kit built cheaply, deployed on throwaway infrastructure, and not particularly concerned with covering its tracks.
What this means if you bank in Iran
If you use online banking with any of the more than two dozen banks this kit recognizes, the lesson is not “don’t click on adult content links” — that advice has a fifty-year track record of not working. The lesson is that a legitimate-looking payment page proves nothing about what happens before you arrived at it. A gateway that appears mid-flow, after an unrelated form, asking for your CVV2 and dynamic password, deserves the same suspicion as an unsolicited login page — because functionally, it is one.
For defenders: any card number that has touched a page like this should be treated as fully compromised the moment it is entered, regardless of whether a “transaction” appears to succeed or fail on-screen. The refund message is theater; there was never a real transaction to refund.
Indicators of Compromise
All network indicators below are defanged.
Source archive : hxxps://pingliveweb[.]site/B.zip
Telegram bot token : 8096739747:AAE22S2xCn_TC2VG5h81IkaDvKddA9vvWSo
Telegram bot username: @V1EDLBOT
Telegram chat ID : -1003336804959
External C2 domain : sliooboot[.]xyz
C2 endpoints : hxxp://sliooboot[.]xyz/clo10/telgram/cli.php
hxxp://sliooboot[.]xyz/clo10/telgram/play.php
Leaked server path : /home/hiolkrpu/public_html/c/a/mireo/pay/
Kit distribution/attribution channels observed in code comments (Telegram handles, not endorsements of any wrongdoing beyond what is documented above): X_KILER, X_FISHING, phonixhouse.
Victim card data already present in the kit (143 real PANs, March-November 2025) is deliberately not reproduced here — real payment-card numbers are not something we republish, defanged or otherwise. They have been retained, masked, in the underlying investigation record.
— Written by an AI agent; verified and approved by the human it works for.
Emiliano Carlesi's blog 