Whalebone

This week on 🔍🐋 BR

We recently flagged and blocked a fraudulent domain offering a pre-approved credit card in Brazil.

💳 The offer: a high limit, instant approval, and no credit check, wrapped in the branding of a well-known Brazilian payments provider and fronted by the face of a famous footballer.

🎯 The hook: it was aimed at people with poor credit or an urgent need for cash, the group least likely to walk away from a generous offer.

⚠️ The catch: the form opened by asking for the visitor's CPF. Pages like this then move on to banking details, or charge an upfront fee for a card that does not exist.

Borrowed trust is the entire model here. A recognizable logo and a familiar face do more work than any technical trick, which is why this pattern keeps returning in new clothes.

Stopping the domain at the DNS level keeps people away from the form entirely. Stay tuned for next week's threats. And stay safe. 🛡️

Every month, quietly and automatically, Whalebone blocks an average of 2.3 billion threats across the networks we protect. That number comes from our own telemetry over the first half of 2026, and behind it sits a simple idea: the safest security is the kind a person never has to think about.

No app to install, no update to run, no click to regret. ✅

For a telco, this is what mass-market network-level security looks like in practice: billions of small saves that add up to trust. 🙌

This week on 🔍🐋 ZA

We recently detected and blocked a fraudulent domain posing as Fines SA, the traffic fine platform drivers across South Africa use to check what they owe.

The page opened with an unpaid fine for a driving offense, complete with a reference number and an amount due. 🚗

Then it asked for exactly what a payment page would ask for: 💳 Card number, expiry date, and CVV (full name and billing details).
There was no fine, and there was no payment. Everything entered went to the attackers.

Fear plus a small sum of money is a dependable combination. Most people would rather settle a few hundred rand than argue with a traffic authority, and the page was built to be paid quickly rather than examined closely.

Blocking the domain at the DNS level means the page never loads. Stay tuned for next week's threats. And stay safe. 🛡️

This week on 🔍🐋 CZ

We recently identified and blocked a fraudulent domain that asked people in the Czech Republic to pay overdue public television fees.

The link arrived by SMS. 📩 The page that opened was a close copy of the Česká televize website, and it pushed visitors straight into a fake BankID login to settle the supposed debt.

The flow was short and effective:

1️⃣ An SMS about an unpaid fee, with a deadline
2️⃣ A convincing replica of a trusted public institution
3️⃣ A fake bank login built to harvest credentials

The timing was uncanny. Television fees had just been through the national news cycle, so a message about them did not feel out of place. Attackers read the headlines as closely as marketers do.

Česká televize confirmed publicly that they do not send payment notices by SMS.

Catching the domain at the DNS level stops the message from leading anywhere at all. Stay tuned for next week's threats. And stay safe. 🛡️

This week on 🔎🐋🇮🇳

We recently spotted and blocked a fraudulent website promising students a free laptop.

The page was built to look like an official government program, so users could easily believe the offer was real.

The scam flow was designed to feel legitimate:
1️⃣ An application form collecting name, phone number, and location
2️⃣ An instant "approved" animation for every submission to build trust
3️⃣ A forced step to share the link with several WhatsApp contacts before continuing

The final "claim your prize" button led nowhere. It trapped users in an endless loop of ads and redirects, generating profit for the scammer while no laptop ever existed.

Blocking threats directly at the DNS level helps reduce risk before people are affected.

Stay tuned for next week's threats. And stay safe. 🛡️

This week on 🔎🐋🇪🇸

We recently uncovered and blocked a fraudulent domain impersonating the Spanish bank BBVA.

The site opened with a simple math problem dressed up as a security check, a small trick that makes the page feel safe and official.

The phishing flow was simple:
1️⃣ The fake "security verification" to lower the user's guard
2️⃣ A redirect to a convincing replica of the bank's account login portal

The aim was to capture banking usernames and passwords, then use them to access real accounts.

Catching the domain at the DNS level stops the threat before anyone is affected.
Stay tuned for next week's threats. And stay safe. 🛡️

A1 Slovenia is live with Whalebone Aura – and with that, every market in the A1 Telekom Austria Group is now powered by Aura.🚀

Whalebone Aura is purpose-built for telcos: white-label, network-level, no installation required.

With Slovenia live, every A1 Group customer who wants cybersecurity built into their network now has it.

, in every A1 market.

Read the full story 👉 https://eu1.hubs.ly/H0xfr6G0

A1 Slovenia Goes Live, Completing Whalebone Aura Rollout Across the Entire A1 Group A1 Slovenia has started offering cybersecurity product A1 Protekt, powered by Whalebone Aura. Every market in the A1 Group is now protected by Whalebone Aura.

This week on 🔎🐋🇻🇳

We recently identified and blocked a fraudulent domain mimicking the Vietnamese postal service.

The homepage copied the real portal, package tracking included, so the whole site looked operational and legitimate. Upon clicking, a login screen popped up, requesting the user's email address and password.

The aim was to capture login credentials and hijack the victim's accounts.

Blocking the domain at the DNS level stops people from ever reaching it.

Stay tuned for next week's threats. And stay safe. 🛡️

This week on 🔎🐋🇨🇴

We recently flagged and blocked a fraudulent domain posing as the logistics company Envia.

The page asked users for their email to check a package, a small ask that feels harmless when you are expecting a delivery.

The phishing flow was simple:
1️⃣ A fake tracking page showing a failed delivery due to a missing address
2️⃣ An "update your details" form requesting full name, mobile number, and home address

The goal was clear. Collect personal data for identity theft and further targeted scams.

Stopping the domain at the DNS level keeps people protected before any damage is done.

Stay tuned for next week's threats. And stay safe. 🛡️

We are pleased to announce that Claro Colombia has launched Claro Shield, a network-level security service powered by Whalebone Aura, becoming our first telco partner in Latin America. 🌎

The service protects mobile postpaid customers automatically against phishing, malware, and other threats, with no installation or maintenance required.

This collaboration strengthens Claro Colombia’s role as a trusted connectivity provider and marks an important step in Whalebone’s global expansion. 🚀

Read more about the collaboration:

Claro Colombia Partners with Whalebone to Launch Claro Shield, Network-Level Security for Mobile Customers Claro Colombia, a leading telecommunications provider and part of the América Móvil group, has introduced Claro Shield, powered by Whalebone Aura, to its B2C mobile postpaid customers. This launch is a significant milestone for both companies –⁠⁠⁠⁠⁠⁠ the first Whalebone Aura deployme...