Guides
Netcraft’s 33-minute claim vs ChainPatrol, what the clocks measure
Netcraft cites a 33-minute median phishing takedown. What that clock measures, which cases it covers, and how ChainPatrol’s three clocks compare. With sources.
ChainPatrol
Team
This comparison is about one question: what each vendor’s speed figure actually measures. It sits under automated takedowns. For the broader comparison see the Netcraft vs ChainPatrol page.
A note before we start. We make ChainPatrol, so read this knowing where we sit. Everything we say about other vendors comes from their own websites and public reviews, linked at the end. If something is out of date, tell us and we’ll fix it.
What Netcraft says
Netcraft says it takes down about a third of the world’s phishing attacks, cites a median phishing takedown time of 33 minutes, and blocks phishing sites through its feeds while takedowns run. It also offers social media and executive monitoring.
What ChainPatrol does
ChainPatrol automates detection, blocking in 20+ wallets and browsers, filing to registrars, hosts and platforms through direct APIs and automated routes, and scheduled follow-up. An operations team handles the cases automation shouldn’t decide alone, such as fan, parody and staff accounts, low-confidence findings and stalled providers. Every case, including the ones still live, is visible in your dashboard with its timestamps.
The clocks
ChainPatrol | Netcraft | |
|---|---|---|
Headline number | No single number; three clocks defined separately | Median phishing takedown of 33 minutes, per Netcraft |
What the clock measures | Block: confirmation to warning. File: confirmation to filing. Takedown: filing to verified removal | Netcraft’s own definition; ask which cases and which start point |
Blocking while takedowns run | 20+ wallets in about 5–10 minutes, browsers in 1–3 hours, confirmed sites only | Through Netcraft’s feeds |
Case mix | Phishing sites plus the accounts, ads and apps that spread them | Phishing sites, high volume |
Still-live cases | Shown in your dashboard with status and timestamps | Not stated |
Where each fits
If you need | Look at |
|---|---|
Raw phishing site volume with feed-based blocking | Netcraft |
Phishing sites plus the fake support, ads and apps around them, for firms whose customers move money | ChainPatrol |
A 33-minute median is a strong number if it measures filing to removal across all cases, and a weak one if it measures a subset. Netcraft doesn’t say on the page, so ask. ChainPatrol defines its clocks on speed next to the timings and reports medians per organization in your dashboard.
Questions to ask any vendor, including us
Which filing routes are automated, and which still go by email?
Which registrars and hosts are integrated directly? Name them.
What exactly goes to a person, and how is that decided?
Can approvals be turned off? What’s the default?
What does your speed number measure, on which cases, over what period?
Does your report show cases that are still live?
Frequently asked questions
Is 33 minutes real?
Netcraft publishes it; we have no reason to doubt the figure, only questions about which clock and which cases. See how to read a vendor SLA.
Why doesn’t ChainPatrol publish one number?
Because one number hides what it excludes. Three clocks with definitions can be checked against your own cases. Takedown time also depends heavily on the registrar, host or platform involved.
Request a complimentary threat assessment or book a 30-minute demo.
Sources
Accessed November 2026. Product details change; check the source for the latest. We refresh this page quarterly.
Related guides
This comparison is about one question: what each vendor’s speed figure actually measures. It sits under automated takedowns. For the broader comparison see the Netcraft vs ChainPatrol page.
A note before we start. We make ChainPatrol, so read this knowing where we sit. Everything we say about other vendors comes from their own websites and public reviews, linked at the end. If something is out of date, tell us and we’ll fix it.
What Netcraft says
Netcraft says it takes down about a third of the world’s phishing attacks, cites a median phishing takedown time of 33 minutes, and blocks phishing sites through its feeds while takedowns run. It also offers social media and executive monitoring.
What ChainPatrol does
ChainPatrol automates detection, blocking in 20+ wallets and browsers, filing to registrars, hosts and platforms through direct APIs and automated routes, and scheduled follow-up. An operations team handles the cases automation shouldn’t decide alone, such as fan, parody and staff accounts, low-confidence findings and stalled providers. Every case, including the ones still live, is visible in your dashboard with its timestamps.
The clocks
ChainPatrol | Netcraft | |
|---|---|---|
Headline number | No single number; three clocks defined separately | Median phishing takedown of 33 minutes, per Netcraft |
What the clock measures | Block: confirmation to warning. File: confirmation to filing. Takedown: filing to verified removal | Netcraft’s own definition; ask which cases and which start point |
Blocking while takedowns run | 20+ wallets in about 5–10 minutes, browsers in 1–3 hours, confirmed sites only | Through Netcraft’s feeds |
Case mix | Phishing sites plus the accounts, ads and apps that spread them | Phishing sites, high volume |
Still-live cases | Shown in your dashboard with status and timestamps | Not stated |
Where each fits
If you need | Look at |
|---|---|
Raw phishing site volume with feed-based blocking | Netcraft |
Phishing sites plus the fake support, ads and apps around them, for firms whose customers move money | ChainPatrol |
A 33-minute median is a strong number if it measures filing to removal across all cases, and a weak one if it measures a subset. Netcraft doesn’t say on the page, so ask. ChainPatrol defines its clocks on speed next to the timings and reports medians per organization in your dashboard.
Questions to ask any vendor, including us
Which filing routes are automated, and which still go by email?
Which registrars and hosts are integrated directly? Name them.
What exactly goes to a person, and how is that decided?
Can approvals be turned off? What’s the default?
What does your speed number measure, on which cases, over what period?
Does your report show cases that are still live?
Frequently asked questions
Is 33 minutes real?
Netcraft publishes it; we have no reason to doubt the figure, only questions about which clock and which cases. See how to read a vendor SLA.
Why doesn’t ChainPatrol publish one number?
Because one number hides what it excludes. Three clocks with definitions can be checked against your own cases. Takedown time also depends heavily on the registrar, host or platform involved.
Request a complimentary threat assessment or book a 30-minute demo.
Sources
Accessed November 2026. Product details change; check the source for the latest. We refresh this page quarterly.
Related guides
See what’s targeting your brand
More buyer’s guides
What ZeroFox and ChainPatrol automate in takedowns: filing routes, registrar integrations, blocking, approvals, follow-up and what reaches people. With sources.
ChainPatrol
Guides
Bolster says most takedowns complete within minutes via host and registrar APIs. How that compares with ChainPatrol’s filing, blocking and safeguards.
ChainPatrol
Guides
Doppel describes agentic AI that automates takedowns with SOC support. How it compares with ChainPatrol’s automated filing, blocking, approvals and escalation.
ChainPatrol
Guides