Why Some Israelis Can’t Open Your New Link

The National Cyber Directorate’s 119 hotline received about 26,500 reports in 2025, 55% more than the year before, and phishing made up 52% of them, according to the directorate’s annual report.

Internet providers have answered by filtering at the router. In wartime figures released in April, Bezeq, Israel’s largest telecom company, said its home routers were blocking about 5.9 million phishing attempts a day.

For most households that is good news. For a small business it comes with a catch that almost nobody talks about, because the person it hurts never sees it. A filter can’t always tell a scam page that went up yesterday from your new booking page that went up yesterday.

The page that wasn’t broken

I found out the way you find out about most network problems: something of mine stopped working, and nothing on my side was broken.

In July, a web address that my own WhatsApp tools connect to stopped loading on a Bezeq line. The server was fine. My main website, running on the same infrastructure, opened normally. Only that newer address failed, and when I looked closer, the request wasn’t reaching my server at all. Bezeq’s network was answering in its place and sending the browser to a block page hosted by SAM, the Israeli security company whose software runs Bezeq’s protection service, Bcyber. Pointing my computer at a different public DNS service, the internet’s address book, is the usual way around a provider’s settings. It changed nothing. On that line, the answer came back rewritten.

For a tool only I use, that was an annoyance. In August it happened to something other people depend on. I build a route app for couriers, and it launched on its own fresh subdomain. That address was blocked. A later one was caught too, this time on my own phone, which showed a security warning instead of the app. What finally worked was the least elegant option: a plain folder on my main site’s address, which had been online for almost two years.

My server’s configuration still carries a note about it, in Hebrew, above that route: “Bypasses blocks on young subdomains (Bezeq’s Bcyber). Don’t delete!” When I set up a new WhatsApp product in early October, the cleaner engineering choice was to give it a subdomain of its own. The same lesson is why it went into a folder instead.

Why new addresses look guilty

I can’t see inside Bezeq’s rules, and Bezeq doesn’t publish them. Its terms of service describe Bcyber only in general terms, as protection for the home network against threats, including sites that impersonate other sites to steal personal details.

What I can see is the pattern in my own case. The addresses that got caught were new. The established one, on the same infrastructure, kept working.

That fits how the security industry thinks. Phishing pages are disposable: they go up, collect what they can and disappear, so a brand-new address is one of the strongest warning signs a filter has. Palo Alto Networks’ Unit 42 researchers reported in 2019 that more than 70% of newly registered domains were malicious, suspicious or not safe for work, and recommended blocking them outright, accepting some false alarms as the price.

From a security point of view, that trade makes sense. From a small business’s point of view, the false alarm is your campaign.

A failure you can’t see

Here is what makes it nasty. When you launch a new booking page, payment link or order form, you test it yourself, probably on your phone’s mobile data or on an office line from another provider. It works. You print the QR code, send the WhatsApp message to your customer list and pay to boost the post.

If your page gets caught, the customer on Bezeq home internet taps the link and gets a warning instead. Some will call to ask. I suspect most will close the tab, and they’d be right to, because that’s what years of anti-phishing campaigns have taught them to do. You see a quiet week and conclude the offer was weak.

Your analytics won’t correct you. A visitor who never reached your page never appears in your numbers.

What to do about it

The fix is cheap once you know the problem exists.

Put new customer-facing pages under the address your business already has. A booking page at yourbusiness.co.il/book sits under a domain with years of history behind it. A new domain such as book-yourbusiness.co.il, or a fresh subdomain, starts with none. In my case, a folder on the old address worked where two new names had failed.

Test from the network your customers actually use. Before the flyers go to print, ask a friend with Bezeq home internet to open the link on their Wi-Fi. It takes two minutes, and it’s the test that would have caught my problem on day one.

If you’re rebranding and need a new domain anyway, launch it early. Put real content on it, give it a few weeks before you aim a campaign at it, and check it again from a Bezeq line before launch day. Unit 42, for what it’s worth, counted a domain as newly registered for its first 32 days.

And when a customer says your link “doesn’t work,” believe them before you blame their phone. The block page has a way to report a mistake, but that puts the work on your customers, one household at a time.

A shield worth keeping

None of this is an argument against filtering at the network. Phishing in Israel is growing fast, and a filter that stops fake bank and delivery pages protects people who would never install security software themselves.

It just has a cost, and the cost falls on whoever is newest: the bakery with its first online order form, the clinic sending patients to a new booking page, the shop that just printed a QR code. Large companies have security teams and old domains. Small ones have a link in a WhatsApp message and no idea why nobody clicked it.

I run Achiya Automation, a small studio that builds WhatsApp bots and automations for Israeli businesses, and since the summer my rule has been simple: anything a customer has to open goes under an address that already exists. It isn’t elegant. It works.

If you run a business in Israel, has a customer ever told you your link wouldn’t open, while it worked fine for you?

Achiya Cohen runs Achiya Automation, a small Israeli studio that builds WhatsApp bots and custom automation for businesses.