Skip to content
Garde

The method

How Garde scores a site

Every scan runs nine independent checks in parallel. Each one adds risk points when it finds something concerning, and the total becomes a score from 0 to 100. Higher means riskier.

The checks

  • Blocklists

    Automatic High Risk

    We check the domain and its parent domains against Phantom's blocklist, MetaMask's eth-phishing-detect, ScamSniffer's scam database, and GoPlus Security. Lists refresh every 6 hours. A match on any list jumps straight to High Risk, and the report names the list that flagged it. Domains on Phantom's or MetaMask's allowlists, or on our own list of official domains, are treated as trusted and never flagged.

  • Redirects and short links

    Up to +20

    We follow every redirect, including bit.ly style short links, meta refresh tags, and script redirects, then run every other check on the site the link really lands on. Hiding the destination behind another domain adds risk unless the destination is a trusted official site.

  • Google Safe Browsing

    Up to +60

    Google tracks sites known for malware, phishing, and unwanted software. If Google has flagged the link, it weighs heavily against the site.

  • Domain age

    Up to +35

    Most wallet drainers live on domains registered days before a campaign. We read the registration date from public RDAP records. Under 30 days adds significant risk; under a year adds a little.

  • Lookalike detection

    Up to +60

    We compare the domain with popular crypto apps like jup.ag, phantom.app, and uniswap.org, looking for near misspellings and character swaps such as 1 for l, 0 for o, or rn for m. We also catch a real brand name paired with bait words, like jup-airdrop.xyz or phantom-claim.com. A close match that is not the real domain is a strong warning sign.

  • Certificate history

    Up to +20

    We read the domain's public certificate history from crt.sh. A site whose first HTTPS certificate was issued days ago is usually brand new. If crt.sh does not answer within 4 seconds, this check is marked unavailable and the scan carries on.

  • SSL / HTTPS

    Up to +15

    We confirm the site serves a valid HTTPS certificate. Valid HTTPS does not prove a site is legitimate, but missing or broken HTTPS is a red flag.

  • Drainer code detection

    Up to +50

    We fetch the page and its scripts from our server, never your browser, and look for drainer patterns: obfuscated code, setApprovalForAll or unlimited approvals, Permit signatures, transaction signing on page load, known drainer kit names, and calls to suspicious domains.

  • Contract addresses

    Up to +50

    We pull Ethereum and Solana addresses from the link and the page, then check them with GoPlus token security and malicious address data. Honeypots, hidden mint functions, and addresses tied to theft add risk.

Score bands

0–39Low Risk
40–69Medium Risk
70–100High Risk

The verdict sentence on each report is built from the checks that contributed the most risk, so you can see the main reason at a glance.

FAQ

Does a Low Risk score mean a site is legitimate?

No. Low Risk means none of our automated checks found warning signs. New drainers appear daily and some are built to evade scanners. Always verify links from official sources.

Why is a site I trust showing Medium Risk?

Legitimate sites can trip checks, for example a brand new domain or heavily minified scripts. Open each check on the report to see exactly what was found.

Does Garde connect to my wallet?

Never. Garde does not ask for a wallet connection, signature, or any keys. All checks run on our servers against the public URL you paste.

What happens when a check is unavailable?

If an external service times out, that check is marked unavailable on the report and does not add to the score. You can press Rescan to try again.

How fresh are results?

Results are cached per domain for 6 hours to keep Garde fast. Each report shows when the scan ran, and Rescan forces a fresh one.

Is there an API?

Yes. Send POST /api/scan with a JSON body like {"url": "example.com"} to receive the full result. GET /api/scan returns usage docs.

Disclaimer

Garde scores are automated risk guidance, not financial or security advice. Always do your own research. Garde never labels a site as a scam or as safe. Scores describe automated risk signals only, can be wrong in either direction, and are not a guarantee of any outcome. Never connect a wallet holding funds you cannot afford to lose to a site you have not verified.

Scan a site