skip to content
Guardly
[ get it ]
Scan. Stop. Earn. · 0.9.0 · internal preview
interactive preview · demo data throughout

the whole extension, at size

Nothing on this page is live. There is no wallet connection, no backend and no paid service behind any panel: the findings, balances, messages and rewards are written into the project as constants so the interface can be shown doing its job.

[ get it → ]

the popup

The toolbar icon carries the score. Opening it gives the verdict, the reason and the two or three findings that produced it, without leaving the page.

Arbitrum Reward Claim · round 4
arb-claim-portal.app/claim
12/100
arb-claim-portal
claim your round 4
rewards
connect walletexpires in 04:11
4,200 ARB allocated to your address
demo data
guardlyscanned 0.3s ago
12/ 100 safe
threat
Drainer signature pattern

This page asks for a Permit2 approval that moves every token you hold, not the one it names. Nine wallets lost funds to this contract in the last four days.

  • wallet address 0x7F3a…B19c
  • contract 0x4d2E…77aF
  • claim link arb-claim-portal.app/claim
[ leave this page ]continue
report this page+4.0 GRD pending verification
8 checks ran locally1 signal queued

your protection

your protectiondemo data · one device · 30 days
scam pages blocked
1,284
this device, last 30 days
unsafe signatures stopped
37
before the wallet opened
useful signals contributed
612
anonymised, after dedupe
rewards pending
128.4GRD
clears after verification

the page scan

Everything found on one page, in the order it was found.

demo data
page scan8 found3 threat3 caution2 clear
  • wallet address0x7F3a…B19cno history before last week, 412 inbound dust transferscaution
  • token contract0xA0b8…eB48USDC, verified source, matches the canonical addresssafe
  • contract0x4d2E…77aFunverified source, owner can move approved balancesthreat
  • claim linkarb-claim-portal.app/claimlookalike domain, not the project's published hostthreat
  • mint linkmint.arb-claim-portal.appmint function is payable and has no supply capcaution
  • payment linkpay.arbitrum.foundation/inv/8841host matches the invoice issuer on recordsafe
  • wallet prompteth_signTypedData_v4Permit2, unlimited amount, spender is the unverified contractthreat
  • signature requestpersonal_signmessage is hex, not readable text, so you cannot see what you agree tocaution
every page, every time · demo data
wallet addressestoken and contract addressesclaim linksmint linkspayment linkswallet promptsphishing pagesdrainer contractsrisky approvalssuspicious signatures

before you sign

The prompt your wallet is about to show you, in sentences.

demo data
before you signdemo data
requesteth_signTypedData_v4
chainEthereum mainnet
asking forPermit2 · approve
  • Gives one address permission to move every USDC in your wallet.
  • The permission does not expire. It stays after you close the page.
  • The page says 0.1 ETH. The signature does not mention an amount at all.
  • Nothing leaves your wallet the moment you sign. The spender takes it later.
what changesnowafter signing
USDC4,120.000.00
ETH1.841.84
approvals34

Do not sign. The amount is unlimited and the spender is six days old.

the wallet inbox

Sorted by what it is, not by who paid to appear.

demo data
wallet inboxdemo data
  • Guardly12m
    An approval you hold went unsafe

    The contract you approved for USDC on 2 March changed owner yesterday. Revoke it.

    alerts
  • Guardly1h
    A page you opened is impersonating a project

    arb-claim-portal.app is not a host Arbitrum publishes. Nothing was signed.

    alerts
  • Arbitrum Foundation3h
    Round 4 claim is open

    Signed by the address in the project's published registry. Expires in 19 days.

    claims
  • unverified sender5h
    You have 4,200 tokens waiting

    Sender paid to reach you and cannot prove who they are. Treated as advertising.

    claims
  • Uniswapyesterday
    Swapped 0.5 ETH for 1,642.18 USDC

    Settled in block 21,884,003. Fee 0.0021 ETH. Matches what the page quoted.

    receipts
  • studio.ethyesterday
    Payment request · 1,200 USDC

    Invoice 8841. Host matches the issuer on record. Due in 7 days.

    requests
  • Lido2d
    Withdrawal queue is clear

    Project update, signed with the key in Lido's published registry.

    updates
  • Guardly3d
    Seed phrase field detected on a page you visited

    No legitimate site asks for twelve words. The page was blocked before it loaded.

    warnings

the rewards ledger

What cleared, what is pending, what paid nothing.

demo data
rewardsdemo data · no token exists
pending verification
128.4GRD
held until each signal is reproduced
cleared, lifetime
904.2GRD
verified by someone other than you
signalweightGRD
drainer contract, first reportverifiedx448.0
lookalike claim domainverifiedx224.0
unlimited approval on a new spenderpending verificationx218.4
seed phrase field on a pagepending verificationx332.0
page already reported by 2,104 othersduplicate, not paidx0—
report that did not reproducerejectedx0—
  • A signal pays once, to whoever saw it first.
  • Verification is independent. A report nobody can reproduce pays nothing.
  • Rewards are funded by the projects and wallets that read the feed, not by selling what you browse.

what is real in here?

[ what is built → ]privacy