Guard3

A second pair of eyes before you sign.

Guard3 warns or blocks before a known crypto phishing page loads, and pauses risky wallet requests so you can see what you are about to approve.

Get Guard3 for Chrome See how it works

Free and open. No account, no sign-up, no personal data collected. Works in Chrome and Firefox.

How it works

Guard3 protects you from fake airdrop, mint and claim pages that trick you into signing a transaction or giving up your recovery phrase. It works in two layers.

Layer 1

Warns before a scam page loads

Every page is checked on your device against reviewed community blocklists and on-page heuristics. Lookalike domains, fake airdrop checkers and known drainer pages get a warning, or a full-page block for the clear ones, before you interact.

Layer 2

Reviews risky wallet requests

When a site asks your wallet to approve, sign or transfer, Guard3 holds the request and shows in plain language what it would really do: unlimited approvals, Permit2, raw signatures, with a live simulation of what would leave your wallet.

On demand

Deep scan when you want certainty

One click runs a closer analysis (an AI verdict plus a decoy-wallet sandbox) and explains, point by point, why a page looks dangerous or why it is probably fine.

Honest by design

Not an alarm machine

Guard3 separates a merely unofficial page from a real drainer and tells you the difference. A suspicious verdict comes with the reasons, so you decide with the full picture.

Privacy

The short version: every page is checked locally first, the full URLs you visit are never sent to us, and the requests that do leave your browser are listed below.

Last updated: 2026-10-19

What stays on your device

Every page you open is evaluated locally in your browser first. The hostname is checked against phishing lists, brand lists and heuristics stored inside the extension. The full URLs you visit are never sent to us or logged.

What leaves your device, and when

  1. List updates (automatic, every 12 hours): updated phishing and brand lists are downloaded from GitHub. These requests carry no information about your browsing.
  2. Domain age lookup (automatic, only for suspicious pages): when the local score is undecided, the extension asks a public registry (RDAP) for the registration date of the domain name only. No path, query string or page content is sent.
  3. Link shortener resolution (automatic, only on x.com): shortened links visible in your timeline are resolved by our server so they can be scored before you click. Your browser does not contact the destination.
  4. X account check (automatic, only for suspicious pages): the project name in the hostname or the handle that carried the link is sent to our server to look up the account. Never the page URL.
  5. Deep scan (only when you press the button): the page address without its query string, a snapshot of the page (title, a text sample, script file names, link domains, wallet-related buttons) and the extension's findings are sent to our server, which asks an AI model for a verdict. The page text is not stored.
  6. Reports (only when you press "Report this site"): the page address without its query string, the score and your optional note are sent for human review. A daily-rotating keyed hash of your IP is kept for abuse prevention and deleted with the report after 90 days.
  7. Transaction simulation (on by default, only when a wallet request is held): the pending transaction is sent straight from your browser to a public RPC node to simulate what would leave your wallet. It is never sent to us, carries no cookies, and nothing is broadcast. You can turn it off in settings.

What we never do

  • We do not sell data, show ads, or share data with third parties beyond the services named above.
  • We do not collect wallet addresses, seed phrases, private keys, form inputs, cookies, or browsing history.
  • The AI API key is stored only on our server; the extension cannot be used to access it.

Your controls

  • Deep scan and reporting are manual; nothing is sent until you press the button.
  • Transaction simulation can be switched off in the settings page.
  • You can mark any domain as trusted or remove it again in settings.
  • Uninstalling the extension removes all locally stored data.

Support

Questions, a false positive, or a scam site we missed? We read every report.

Report an issue

Open an issue on GitHub: github.com/0xnesQuit/web3-phish-guard-lists/issues. Include the site and what you expected.

Report a scam site

Use the "Report this site" button in the extension on the page itself. A moderator reviews reports before anything is added to the public blocklist.