Online threats are everywhere. Trackers, ads, malware, and scams are all out to harvest our data, so it's vital we protect ourselves.
NordVPN's Threat Protection Pro is doing just that. We rate NordVPN as the best VPN currently available, and the effectiveness of Threat Protection Pro is a contributing factor to that title. It has been independently rated as the best VPN malware protection by AV-Test, and has already blocked over 300 million scams this year.
Data collected by NordVPN has shown a 13.9% increase in blocks compared to this time last year. Scammers are impersonating popular companies – including Google, Yahoo, and Facebook – to steal your information. What's more, video hosting domains are some of the riskiest out there.
Here we'll break down this data and share top tips for protecting yourself against scams and intrusive data collection.
Billions of ads, trackers, and malware blocked
March 2025 saw Threat Protection Pro block over 5 billion ads, 960 million cases of malware, and 61 billion trackers – the highest month in the data collection period (January 1 2024 to April 1 2025).
The sole purpose of malware is to harm your device and steal information. It includes malicious software such as viruses, ransomware, and spyware. Malware can steal sensitive data, encrypt files, and even grant cybercriminals complete control over your device.
Research found at least 20 common malware types, with hundreds of thousands of attacks intercepted. The top five malware included:
- APC: a virus targeting system configurations and automated processes
- APC.AVAHC: an APC variant able to avoid detection and persist in infected systems
- Redcap.ovgfv: a specific strain of the Redcap trojan, used for data exfiltration and system manipulation
- APC.YAV: an APC variant that changes system files and settings
- OfferCore.Gen: Adware that generates intrusive ads and can install unwanted software on infected devices
Fake URLs
Cybercriminals are impersonating brands and using fake URLs to scam you and harvest your data. Google is by far the most impersonated company, with 133,642 fake URLs recorded. Facebook is second, with 14,627, and Yahoo third, with 11,545. Telegram and Microsoft make up the top five, with just over and just under 11,000 respectively.
99% of all phishing attacks use just 300 brands for deception, and it is vital you double check URLs and the message content to confirm its authenticity. Never click on a link or hand over personal information if you're not 100% it's genuine.
Misspelt or shortened links, too-good-to-be-true offers, and poor website quality are all common giveaways. However, protections such as Threat Protection Pro are useful for checking links and pages that are more sophisticated and harder to spot.
Watch out for files
Hackers can disguise malware as an innocent looking file and certain file types are more commonly used than others. With 962,066 threats detected, .exe files are by far the greatest risk. Second are .zip files (183,434 threats) and .php third (95,763 threats). Other commonly seen files included .pdf (64,090 threats) and .html (28,885 threats).
As with suspicious links, caution should be exercised if you receive a suspicious file – especially if you're not expecting it.
Domains are another way of spreading malware, with over half of all malware blocked by Threat Protection Pro coming from pages with adult content.
Video hosting sites saw over 2 billion cases of malware blocked, and file sharing and storage saw 1.7 billion blocked. Entertainment was the third domain category to record over one billion cases of blocked malware.
A global problem
Between January 1, 2024, and January 1, 2025, the U.S. experienced the highest number of malware incidents with 1.9 billion – the only country to exceed one billion.
The UK saw 948 million incidents, the second highest, and Canada was third with 553 million.
Puerto Rico saw the highest number of incidents per device, recording 6,751. Norway was second with 4,574, and Kenya just behind with 4,093.
The U.S. saw 1,270 incidents per device and the UK recorded 1,479.
Protect yourself from scams
NordVPN's Threat Protection Pro will protect you from being scammed. Between September 2024 and March 2025, Threat Protection Pro blocked over 507 million scams – but you shouldn't just rely on VPN threat protection features.
Follow good privacy practices. As mentioned above, don't click on any links, files, or domains you're not 100% sure are safe and always be cautious when handing over personal information.
Use a VPN to encrypt your internet traffic and protect your online data, and always use one when connecting to free and public Wi-Fi as these networks may be compromised by hackers.
Use one of the best password managers to generate and store unique, complex passwords for all of your accounts to ensure they're secure and protected.
VPNs themselves can't protect you if you are the victim of a scam, but some do offer identity protection features. NordVPN's NordProtect and ExpressVPN's Identity Defender provide insurance, dark web monitoring, and credit scans.
NordProtect is available as a standalone product or as part of NordVPN's most premium plan, NordVPN Prime, for $6.99 per month. ExpressVPN includes Identity Defender in its standard two-year $4.99 per month plan at no extra cost. However, both features are currently available to U.S. users only.
Disclaimer
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
