Dark web monitoring
How dark web monitoring works at ChainPatrol
What we search, what you can track, how findings are graded and how they reach your team. Plus what it doesn’t do.
Last updated: October 26, 2026
How it works
From target to finding
Every search is tied to a target you set, so results stay relevant to your organization.
1
Track
Add your email domains, individual staff addresses and official wallet addresses as brand assets in the ChainPatrol app. Individual addresses can include public providers like Gmail.
2
Search
We search dark web leak data for records tied to those targets. Each finding shows its source and date.
3
Grade
Each finding is graded Critical, High, Medium or Low, so your team works the list from the top.
Critical
plaintext password, last 12 months
Per brand
search quotas set for each brand
4
Deliver
Findings reach your team in Slack, in the ChainPatrol app and through the API.
Delivery
How findings reach you
Three ways to see and work findings.
Slack alerts
A Slack alert when leaks increase for a monitored domain, with a link back to the finding.
The ChainPatrol app
Findings with sensitive values masked. Domain searches can be grouped by person. Acknowledge findings one at a time or in bulk.
API and export
Export findings to CSV, or search credentials by domain, address or wallet through the external API.
Scope
What it doesn’t do
Dark web monitoring shows you what’s exposed. Acting on it stays with your team, and takedowns go through our brand protection service.
It doesn’t reset passwords, revoke sessions or change access. Your team does that, with the finding in hand.
It doesn’t run open-ended searches. Every search is tied to a target you’ve added.
It doesn’t take anything down by itself. If a finding turns into a phishing site or fake account, ChainPatrol’s brand protection service handles the takedown.
Severity
How findings are graded
Critical findings are the ones most likely to still work. Everything else ranks below them.
Critical
A plaintext password exposed in the last 12 months.
High
An older plaintext password, or payment card data exposed with the record.
Medium
A hashed password, or personal data exposed without a password.
Low
The address appears in a leak with nothing else exposed.
Common questions
Not in the broad sense. Threat intelligence platforms track actors and campaigns. This finds leaked data about your organization and tells you how urgent it is.
See it on your own domains
Free threat scan. Results within 48 hours.
Prefer a walkthrough? Book a 30-minute demo.
By submitting you agree to ChainPatrol’s terms. We never share your data.
ChainPatrol is a fully managed brand protection service for firms whose customers move money. It finds impersonation, blocks confirmed phishing sites in wallets and browsers, files and follows up takedowns across platforms, and reports on what’s been removed and what’s still live.