Phishing links and malware downloads almost always start with a domain lookup. ThetaSecurity OS answers that lookup on the device, and refuses the bad ones before any data leaves the phone.
How it works
- Local loopbackAn on-device VPN loopback service intercepts every DNS query from every app.
- Offline Bloom filterEach domain is checked against an encrypted, offline Bloom filter of known phishing and malware distribution hosts. The check is fast and needs no network.
- Block locallyA match is refused on the phone. The connection never starts, so there is nothing for an attacker’s server to answer.
Why “zero-hop”
Cloud filters send every domain you visit to someone else’s server so it can decide. That server then has your browsing history. The sinkhole makes the decision with zero hops off the device. No one learns which domains you looked up, including ThetaSecurity.
The filter is updated with the system image, which is signed and verified like the rest of the OS. A Bloom filter can rarely flag a harmless domain. Sentinel tells you when a block happens, and you can allow a domain you trust.