A second pair of eyes before you sign.

Guard3 is a browser extension that protects crypto users from phishing sites and wallet drainers. This page explains, in full, what it does, how each layer works, exactly which attacks it stops, and, just as honestly, the situations where it cannot protect you.

Chrome and Firefox No account, no tracking Checks run on your device Open source

Overview

What Guard3 is, and the one idea behind it.

Most crypto theft today is not a smart-contract hack. It is a person being tricked: a fake airdrop page, a lookalike domain, a drainer that asks your wallet for one unlimited approval, a fake "verify you are human" box that makes you run malware yourself. Guard3 sits between you and those moments.

The core idea: to steal your funds, an attacker must eventually get your wallet to sign or send something, and that request has to pass through your browser. Guard3 watches the pages you open and, more importantly, the wallet requests those pages make, and it warns or blocks before the dangerous step completes. It judges what a transaction would actually do, not just how a site looks.

What you get out of the box: a warning or a full-page block before a known scam page loads, a plain-language review of risky wallet requests before they reach your wallet, and an on-demand deep analysis when you want certainty. No account, no sign-up, and no browsing history collected.

How it works: the four layers

Guard3 is defense in depth. If one layer misses, the next still has a chance. Each later layer judges something more concrete than the one before it.

1. On-load page check

The moment a page loads, it is scored on your device against phishing blocklists, brand data and on-page signals. Dangerous pages get a warning or a full-page block before you interact.

2. The wallet gate

Guard3 wraps the page's wallet connection. When a site asks to approve, sign or send, the request is held and shown to you in plain language, with a live simulation, before it reaches your wallet.

3. Deep scan

One click runs a closer look: an AI verdict plus a decoy-wallet sandbox that opens the page in an isolated browser and watches what it tries to do.

4. Address screening

At the gate, the counterparty address is checked against known-scam and sanctioned lists, locally and, if you allow it, online.

The key design choice: the wallet gate (layer 2) is the last line and the strongest, because it works at the protocol level. Even if the page looked clean and no list flagged it, the moment it asks your wallet to do something dangerous, Guard3 is already in the path.

1. On-load page check

Catches known and lookalike scam pages before you touch them. Runs entirely on your device; your full URLs never leave the browser for this.

What it looks at

Community blocklists. Known phishing and drainer hosts from reviewed sources (MetaMask, ScamSniffer, PhishDestroy and Guard3's own moderated community list). A listed host is blocked by the browser before anything on it can run.
Brand impersonation. Guard3 knows the official domains of many crypto projects. A page that carries a project's name on a domain the project does not own is flagged, including short-token lookalikes and homoglyph or typosquat tricks.
Domain age. A domain registered days ago that imitates a real brand is a strong scam signal. Age is resolved from public registries (RDAP), then certificate-transparency, then a paid WHOIS fallback when the free sources are blind.
On-page signals (one cheap pass). A recovery-phrase field on load, drainer-kit script URLs, a brand name in the title that the domain does not own, and a page that asks your wallet to connect before you click anything.
Where you came from. Arriving on a claim page from an X link or an ad is itself part of the risk picture.

These combine into a score. Low is clean, a middle band warns, a high band blocks the page full-screen with the reasons laid out. Known-blocklist hosts are blocked at the network level regardless.

2. The wallet gate

The heart of Guard3. It interposes between a website and your wallet for the requests that can move funds.

Where it sits

Guard3 wraps the page's wallet provider (window.ethereum and the wallets a page announces) the moment the page starts, using captured browser built-ins so a hostile page cannot un-hook it. Every wallet interaction the page makes passes through this one point, before your actual wallet (MetaMask, Rabby, and so on) ever sees it.

What it holds

It intercepts the signing requests that can move or authorize assets: a transaction send, an approve or unlimited approve, Permit and Permit2 signatures, setApprovalForAll, raw eth_sign, Seaport and Blur orders, and EIP-7702 delegations.

What it shows you

Plain-language decode. What the request actually does: "this gives an unlimited spend of your USDC to this address", not a hex blob.
Live simulation. The pending transaction is simulated against a public node so the dialog can say what would really leave your wallet and what would come back, before you sign.
Counterparty screening. The spender or recipient is checked against scam lists (see layer 4).
A clear choice. Allow forwards the request to your real wallet; deny rejects it and your wallet never even opens.

When it interrupts (and when it stays out of the way)

By default Guard3 is risk-targeted, not an alarm on every transaction. It holds a request when there is a reason: a high-risk action (unlimited approval, Permit2, setApprovalForAll, raw sign, a delegation), a poisoned or raw-wallet counterparty, or a page that is already suspicious. On a site you trust it stays out of the way. If you want the Pocket-Universe style "check everything", Strict mode makes it confirm every signing request, on every site.

Simulation-spoofing guard. A clever drainer can show a harmless preview, then flip the contract state so the same signed transaction drains on execution. Guard3 re-simulates right before signing and asks again if the outcome changed.

3. Deep scan

An on-demand, deeper analysis for when the automatic layers are not enough and you want certainty.

AI verdict. A snapshot of the page (title, a text sample, script names, link domains, wallet buttons) plus the extension's own findings are sent to Guard3's server, which asks an AI model whether it is a scam and why, in plain language. The page content is treated as untrusted; injection text like "ignore previous instructions" is treated as a scam signal, not followed.
Decoy-wallet sandbox. In parallel, a server-side headless browser opens the page in an isolated, throwaway environment with a fake wallet. It records every request the page makes to that wallet, rejects the dangerous ones, and reports what the page tried to do, without risking anything of yours.
Escalation. A confident "dangerous" verdict escalates the page to a full-page block, and clearly-malicious hosts can be added to the moderated community list that protects everyone.

The deep-scan verdict is shown with its reasons. A result is never pushed below what the local checks already found; the two are combined, so the AI can only make a verdict stronger, never talk you into "safe".

4. Address screening

At the gate, is the address you are about to pay or approve a known bad one?

Offline lists (always on, no network). A local copy of the OFAC sanctioned list and the MyEtherWallet darklist ships in the extension and is checked instantly against the counterparty, with no network request. This works even when online screening is turned off.
Online screening (optional, default on). The address is also checked against the GoPlus malicious-address database and the latest OFAC and MyEtherWallet data through Guard3's server. The address is one the transaction would send on-chain anyway; no page, wallet balance or amount is sent.
False-positive safety. Well-known-good contracts (Uniswap Permit2 and routers, OpenSea Seaport, and the gate's known-contract table) and your own address are never flagged. A match adds a clear warning row to the gate.

Privacy switch. Turning off online screening gives you a network-free posture at the gate: the offline sanctioned and darklist checks still run locally, so known-bad addresses are still caught without any address leaving your device.

What Guard3 stops, and how

Attack by attack. The honest limitations for each are in the next section.

Attack	How Guard3 defends
Phishing and lookalike sites (fake airdrop, mint, claim, checker pages)	On-load blocklists, brand-impersonation and domain-age heuristics, and a full-page block for clear cases. Deep scan for the uncertain ones.
Wallet drainers (unlimited approve, Permit2, setApprovalForAll, drain transactions)	The gate holds the request, decodes what it really does, and simulates what would leave your wallet, before you sign. Risk-targeted by default, every transaction in Strict mode.
Seed-phrase harvesters (fake wallet-restore pages)	A recovery-phrase field on a web page is near-certain fraud and is flagged on load; paste protection warns if you try to enter a seed phrase into a page.
Malicious and sanctioned addresses	The counterparty is screened at the gate against OFAC, the MyEtherWallet darklist and GoPlus, both offline and online.
Address poisoning (lookalike address swapped in)	A page that replaces the address you copied is detected; at a dApp send, the gate shows the real destination you are signing to.
ClickFix / fake CAPTCHA (paste-and-run malware)	Detected at the browser stage, see the section below.
Fake wallets (a page announcing a wallet it is not)	EIP-6963 wallet announcements are checked; a fake identity is flagged.
Simulation spoofing	Re-simulation right before signing catches a preview that was flipped after you approved it.
Drainer-kit scripts on compromised sites (including legit sites hit by a server CVE)	Known drainer-kit markers are detected; the gate judges the wallet request by what it does, not by how trusted the site is (fully, with Strict mode on).

ClickFix (fake CAPTCHA, paste-and-run)

A rising attack worth its own section, because the protection is specific and the limit is important.

A page poses as a Cloudflare or "verify you are human" check and tells you to press Windows+R, paste, and hit Enter. The page has quietly copied a malicious command to your clipboard; you run it yourself, and it installs an info-stealer that drains wallets and steals everything.

How Guard3 defends, at the browser stage

Clipboard watch. If a page copies a system command (PowerShell, mshta, curl piped to a shell, and similar) to your clipboard, Guard3 detects it and warns you never to paste it.
Lure-text detection. Guard3 also reads the fake instructions as the page renders, before you click: a "run a command" step plus a "paste" step. The Windows Run-dialog pattern triggers on its own; the Terminal variant also requires fake-verification wording, so a normal developer install page ("open your terminal and paste this") is not flagged.

The hard limit: once you actually run the command in your own terminal or Run dialog, it is outside the browser, and a browser extension cannot stop it. That is your operating system's and antivirus's job. Guard3's protection is to catch the lure and the clipboard poisoning and warn you before you paste.

Where Guard3 is strong

The situations where it protects you well.

You open a fake airdrop, mint or claim page, especially a lookalike domain of a real project. The on-load layer usually catches it before you interact.
A dApp (or a scam site) asks your wallet to approve, sign or drain through the page. The gate holds it, simulates it, and shows you what it really does, even if the site itself looked fine.
You are about to pay or approve a known scam or sanctioned address. It is flagged at the gate, online or offline.
A page tries the ClickFix clipboard trick. You are warned before you paste.
A site shows a harmless preview, then flips it at signing time. The re-simulation catches it.
A compromised but otherwise legit site (for example one hit by a server vulnerability) starts serving a drainer. The gate judges the wallet request itself; with Strict mode on it is caught even on sites you trust.

Where Guard3 will not protect you

Read this part carefully. A security tool that overstates itself is dangerous. Here is where Guard3 is blind or partial, and why.

It cannot see inside your wallet's own screens

Guard3 watches what web pages ask your wallet through the page connection. If you open MetaMask's own interface and type or paste an address and send directly from there, that flow never touches a web page, and no extension can see inside another extension. So the classic "copy a poisoned address from your history and paste it into MetaMask" is outside Guard3's reach. There your wallet's own warnings and a hardware wallet's on-device check are the defense.

Mobile WalletConnect flows

A connection made through WalletConnect to a phone wallet can bypass the page's injected provider. Guard3 has only a weaker signal here (it notices the WalletConnect dialog), not the full gate.

After you run a command yourself (ClickFix)

As above: once a pasted command executes in your operating system, a browser extension cannot undo it. Guard3 protects at the browser stage, not after execution.

General credential theft and device exploits

Guard3 is crypto-specific. It does not protect your email or bank passwords, and it is not antivirus. A browser or operating-system exploit, or malware already on your machine, is out of scope. Keep your browser and OS patched.

A real domain served over a forged certificate (CA or MITM attacks)

If an attacker can serve a malicious page at a project's real domain with a valid-looking certificate (a compromised certificate authority plus a network position), Guard3's domain and brand layer is blind, because the domain really is the correct one. The defense that still applies is the gate: if that page tries to drain your wallet, the transaction simulation still shows what it would do. The primary fix for a compromised CA is your browser distrusting it, not an extension.

Coverage gaps and timing

Brand-new scams. Lists are reactive. A freshly spun-up drainer address or domain may not be on any list yet. The heuristics and the simulation still apply, but a list hit is not guaranteed.
Non-EVM scam addresses. Address screening covers EVM chains well; for Solana and Tron the address lists are sparse (sanctioned addresses aside).
True first-paint certainty. The strongest on-page signals are read a moment after the page parses, which is still before you click, but not literally the first pixel.

If you turn protections off

Settings let you reduce protection (turn off on-page warnings, turn off online address screening). That is your choice, shown with a clear warning. Known-phishing hosts stay blocked by the browser even then, but the softer warnings will not appear.

Bottom line. Guard3 is strongest exactly where most crypto theft happens: a scam page, and a wallet request through a page. It is weak or blind on things outside the browser (your wallet's own send screen, your operating system) and on attacks that need infrastructure-level compromise. It is one strong layer, not a guarantee. Verify large transfers independently, and use a hardware wallet.

Security measures and engineering

The choices that make the protection itself hard to defeat.

Un-removable provider hook. The wallet interception uses captured browser built-ins, so a hostile page cannot redefine prototypes to un-hook or bypass it.
Isolated UI. Guard3's in-page dialog and warning card render in a closed shadow DOM, isolated from the page, so a page cannot read or forge them.
Nonce-guarded block page. The full-page block reads its data from a one-shot nonce, so a web page cannot open it with a forged host to talk you past it.
Simulation before signing, and again at signing. Not just a preview, but a re-check to defeat preview-then-flip drainers.
Honest verdicts. A "clean" result means "no phishing signals found", not "verified safe", and the UI is tuned not to over-reassure on unknown sites.
Keys never in the client. The AI and paid-data keys live only on Guard3's server, reached through a rate-limited endpoint; the extension cannot read them.
Hardened sandbox host. The decoy-wallet sandbox runs in an isolated container on a locked-down host: it opens hostile pages, but firewall rules block it from reaching the host's own services, the cloud metadata endpoint or private networks, and its Node runtime is kept patched.

Privacy

What stays on your device, and the few things that leave it, with the reason.

Every page is scored locally first; the full URLs you visit are never sent or logged. The requests that do leave your browser are limited and purposeful:

List updates (automatic): phishing and brand lists are downloaded; they carry nothing about your browsing.
Domain age (only for suspicious pages): just the domain name is looked up, never the path or page.
Deep scan (only when you press the button): a snapshot of the current page is sent for the AI and sandbox analysis; the page text is not stored.
Counterparty address check (only when a wallet request is held, and only if online screening is on): the address being approved or paid is checked; it is one the transaction would send on-chain anyway. Turn it off for a network-free gate.
Transaction simulation (when a request is held): the pending transaction is sent straight from your browser to a public RPC, never to us, and nothing is broadcast.

No wallet addresses, seed phrases, private keys, form inputs, cookies or browsing history are collected. There is a full privacy policy on the home page.

Settings and controls

You stay in control; the defaults protect a non-technical user out of the box.

Setting	What it does	Default
Page protection	On the page / toolbar only / off. "Off" removes the on-page warnings (known-phishing blocklist stays enforced by the browser).	On the page
Strict mode	Confirm every transaction, even on trusted sites. More interruptions, wider coverage. Closes the compromised-trusted-site gap.	Off
Address screening	Check the counterparty online. Off keeps the local offline OFAC and darklist check, with no network at the gate.	On
Transaction simulation	Simulate held transactions through a public RPC.	On
Trusted domains	Sites you have marked as trusted, managed by you.	Empty

Open source

Transparency over obscurity.

Guard3 is being open sourced: the extension, the server and the sandbox. You can read exactly what it does and verify that no data is misused. The secrets (API keys, tokens) are never part of the code; they live only as server-side secrets. The trade-off of publishing the detection logic is that attackers can read it too, which we accept: the strongest layers (blocklists, the AI, the community signals and the signing-time simulation) are not defeated by reading the source, and transparency earns more trust than it costs.

Questions, a false positive, or a scam site we missed? There is a report button in the extension, and a support link on the home page.