A fake login page
can't fool your browser.
Utilvo PhishBuster reads the page itself — layout, form fields, even fake browser popups drawn in pure HTML — and catches copies of 30 real brand login pages the instant they load. Free, no account.
Works in Chrome, Edge & Brave · Not yet on the Web Store — see why below
Faithful recreation of PhishBuster's real popup — your own counters start at zero on install.
What catching a fake actually looks like
Same look, wrong address bar
A copied login form is convincing to a person skimming it — but the moment it loads, PhishBuster checks the page's real keywords, field names, and structure against the actual brand it's imitating.
- Checked against the brand's real official domains first
- Needs multiple matching signals together, not one keyword
- Navigates you away before a password field is ever visible to type into
- A floating div positioned to look like a native popup window
- A fake address bar showing a real domain like accounts.google.com
- A fake padlock and "https://" secure indicator
- Fake minimize/maximize/close window controls
The popup was never a popup
A real OAuth login opens a genuine browser window with a genuine address bar. A BitB attack fakes all of that inside the page itself — so PhishBuster reads the DOM directly, not what the page appears to be.
- Scanned continuously — fake popups can appear any time after load
- A real address bar and padlock are browser chrome; a fake one is just DOM
- The HTML signatures BitB requires are distinctive and easy to catch
30 brands, and counting
From the accounts everyone has, to the wallets and webmail providers phishing kits copy most often.
- Email, social, banking, gaming, and crypto — the targets kits copy most
- Signatures live in one shared file, so coverage expands without an update
- Matched pages, brands, and scores land in your audit dashboard
Faithful recreations of PhishBuster's real UI — not placeholder mockups.
Everything running underneath
No feature here is aspirational — each one maps to actual code.
Visual Layout & DOM Matching
Scans page text, form field names, and structure against real brand login-page signatures — not just the domain name.
Browser-in-the-Browser Detection
Catches fake browser windows drawn entirely in HTML/CSS — spoofed address bar, padlock, and window controls included.
30 Protected Brand Signatures
Google, PayPal, Microsoft, Apple, Amazon, GitHub, and 24 more — spanning email, social, banking, gaming, and crypto.
Full-Page Interception
A confirmed match navigates the tab to a dedicated warning page — not a dismissible overlay the fake page's own script could hide.
Strict Layout Matching
Lower the match threshold from 70% to 55% for more aggressive detection, or keep it standard for fewer false positives.
Pause Anytime
One master toggle stops both detection engines instantly, across every open tab.
Real-Time Activity Feed
Every intercepted page shows up in the popup immediately — brand, domain, and match score.
Full Audit Dashboard
A searchable history of every threat caught, plus the brand-signature list and sensitivity controls, in one panel.
"Proceed Anyway" That Actually Works
Choosing to continue marks the page trusted for the session — no infinite warning loop on reload.
Not on the Web Store yet — here's why that's fine
PhishBuster ships straight to you instead of waiting on store review — four clicks, no restart.
Download the extension
Grab the .zip package below — no Chrome Web Store account or install fee.
Unzip it locally
Extract the archive to any folder and keep it there — Chrome loads the extension from this folder.
Open chrome://extensions
Enable "Developer mode" using the toggle in the top-right corner.
Load unpacked
Click "Load unpacked," select the folder. PhishBuster is active immediately — no restart needed.
What changes when it's running
A standard browser has no concept of "this form looks exactly like Google's."
Privacy, in two sentences
Page text, form field names, and DOM structure — checked locally against the brand-signature list. Nothing is sent to a server for analysis.
Every warning shows exactly which brand and detection type triggered it, and lets you proceed anyway if you're confident it's a false positive.
Frequently asked questions
How is this different from Utilvo Shield?
Shield checks a URL's reputation and blocks known-bad domains before the page loads. PhishBuster looks at the page's actual content and layout after it loads, specifically for pages built to visually copy a real brand's login form — including brand-new fake pages no reputation feed has seen yet.
What exactly is a Browser-in-the-Browser (BitB) attack?
A fake browser popup window drawn entirely with HTML and CSS inside the page itself — complete with a spoofed address bar showing a real domain like accounts.google.com, a fake padlock, and fake window controls. It looks like a real OAuth login popup, but it's just a div. PhishBuster scans for the specific HTML signatures this technique requires.
Will it flag legitimate pages that just mention a brand?
Detection requires multiple signals together — brand-specific keywords, matching form field names, and (for the strongest cases) a password field, all on a domain that isn't the brand's own. An article that mentions "Sign in with Google" once won't trigger it on its own.
What happens when it catches a fake page?
Your tab navigates to a dedicated warning page showing the brand it was impersonating, the detection type, and a match score — the same interception pattern Utilvo Shield uses. You can go back, or proceed anyway if you're confident it's a false positive.
Why isn't this on the Chrome Web Store yet?
PhishBuster is in active development. Rather than wait for store review, we're shipping the current build directly so early users can try it now — install takes under a minute via Chrome's Developer Mode.
Does it cover my bank or a brand not in the list?
Only the 30 signatures listed on this page are actively matched today. Coverage is expanding — the brand database is a single shared file, so adding one is straightforward as new high-value targets come up.
Install it before the next login page you land on
Free, local-first, and ready in under a minute — no Chrome Web Store account, no signup.