// security

Protection Against Malware and Phishing Sites: How It Works

proxyvpn Blog · ~4 min read

Every ProxyVPN account is protected by default against malware and phishing sites — the connection is cut before the page even has a chance to load. Let's break down what this actually means in practice, what the filtering is based on, and how to turn it off if you need to.

What exactly gets blocked

The filter relies on two open sources, each updated daily: URLhaus by abuse.ch — a list of domains that are actively distributing malware right now, and OpenPhish — a feed of active phishing pages (fake login pages for banks, crypto wallets, email services). The lists are merged, deduplicated, and applied automatically to all servers — the current set is around 700 domains.

How this works technically

The block happens at the traffic-routing level on the server: when a connection is established, the server sees which domain is being requested (via the SNI in the TLS connection), and if the domain is on the list, the connection is cut right there, before your device receives a single byte of the page.

This isn't a DNS response substitution and it isn't page-content interception: the service still doesn't see or log which sites you normally visit. The rule only triggers on an exact match with an already-confirmed malicious domain from the list — the rest of your traffic isn't analyzed or stored by the filter.

This isn't a full antivirus — the filter doesn't scan files, attachments, or anything already downloaded to your device. It only blocks connections to domains already confirmed to be distributing malware or running phishing. Full content inspection would require parsing your traffic — and we deliberately don't do that, since it would contradict our "no logs" promise.

How to turn it off

The filter is on by default for all accounts. If it's getting in your way — for example, if it wrongly blocked a resource you need — you can turn it off from your account dashboard, in the subscription settings. Since this affects routing rules shared across all clients, the opt-out is processed manually: usually within 1-3 hours, at most within a day.

Still have questions about the filtering?

See the FAQ →