Messages have been identified through which citizens are sent notifications about water bills, requesting payment through links.
One such message, sent to hibrid.info by a reader, had the telephone prefix "+63" and was presented, as it says, on behalf of the Kosovo Water Company.
The content of the message claims that the recipient of this message must pay the unpaid bill within 24 hours to prevent service interruptions.
What is the truth?
Messages like this are misleading.
Hibrid.info noticed that the telephone prefix of the sender of this message does not belong to the state of Kosovo. Research showed that the prefix “+63” is used in the state of the Philippines (see here).
For a more accurate analysis, the link contained in the message was checked directly (see here).
After clicking on the link, a digital page opened with the logo of the Regional Water Company (RWC) "Prishtina".
At the top of the page, a red notification appears alerting the consumer that the current balance is negative (-€2.79), requiring the account to be topped up to avoid interruption of water supply. To this end, several predefined payment options are offered (€5.00, €10.00, €15.00 and €20.00), as well as the possibility of setting a personalized value.
Next, the form requires filling in bank details—such as the cardholder’s name, card number, expiration date, and security code (CVV)—before clicking the “CONFIRM REFILL” button. Immediately below it is a separate space for the billing address, where personal and location details are requested, including phone number, email, address, city, region, and postal code.
Finally, the information section contains quick links, the services offered by the company, the official contact details of the RWC "Prishtina", as well as the copyright notice.
Due to doubts, the research was not continued with the provision of the requested data.
Although the open page contains the logo and has some elements similar to the website of the KRU "Prishtina", hibrid.info has found that it is not the official website of this company.
Hibrid.info checked the search engine “Google” and found that the official domain of this company's website is “kru-prishtina.com/a/” (see here).
This company's website offers the option of direct payment, but to make it happen, registration and user account login are required.
Hibrid.info also checked the URL of the link contained in the message, through the "urlscan" service.
After scanning, it was found that the website is located in Frankfurt am Main, Germany, under the China-based TENCENT-NET-AP-CN network. Its TLS certificate was issued by YR1 on June 23, 2026 with a validity of 3 months. The site is built with WordPress and Vue.js technologies, generating 14 HTTP requests to 5 IP addresses in 3 different countries during the scan.
The Prishtina RWC reacted to similar messages with a post published on Tuesday (June 23) on its official Facebook page. The post states that messages like this are not official communications from the Prishtina RWC and should be completely ignored.
The text specifies that this number is suspected of a fraud attempt (phishing), therefore it calls on consumers not to share personal data or banking information through it, but to refer only to the company's official channels (see here).
Analyze:
The messages about water bills are suspicious.
Such messages contain typical elements of fraudulent schemes, including the use of the Philippine telephone prefix (+63) and urgent demands for payment within 24 hours to prevent service interruption through suspicious links.
Analysis of the link included in the message shows a page that imitates the company KRU "Prishtina", but uses a different domain than the official one and requires filling in banking and personal data, which is not practiced in this form by the official website.
Technical scans show that the site is hosted on external infrastructure under a China-based network, with a short-term security certificate.
Also, KRU "Prishtina" has publicly confirmed that such messages are not official company communications and has called on citizens to ignore them and not share sensitive information.
Therefore, based on the evaluation methodology, hibrid.info rates the content as "Fraud".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.