ChainPatrol is a brand protection platform that stops impersonation and phishing attacks targeting your brand and your people. We scan the internet for fake domains, social media profiles, Telegram channels, app store listings, and other impersonations — then block malicious domains across 20+ crypto wallets and browsers, and handle full legal takedowns to get threats removed at the source.

Three things. First, thorough detection: our combination of automated scanning and AI-powered analysis catches impersonations others miss — including sophisticated attacks like bot accounts posing as regular users who DM your community with malicious links. Second, speed at scale: we block malicious domains across wallets within minutes and handle thousands of takedowns per day for individual customers. Third, crypto-native integrations: we're directly integrated with MetaMask, Phantom, Coinbase Wallet, WalletConnect, and 20+ other wallets, plus Google Safe Browsing for browser-level blocking.

We cover direct brand impersonation (fake websites and social profiles), employee and executive impersonation, fake support accounts targeting your community, phishing domains, app store impersonations, fake browser extensions, and scam ads. We also handle more advanced cases — like bot networks that send malicious links in DMs while posing as real users.

We monitor newly registered domains daily and perform deep scans across social media platforms including X (Twitter), LinkedIn, Facebook, Telegram, YouTube, Discord, and more. We also scan for email impersonation, fake phone numbers, app store impersonations, and fake browser extensions.

For domains, we analyze DNS, WHOIS/RDAP records, IP information, HTML content, and full-page screenshots. For social media profiles, we examine profile pictures, bios, account statistics like age and follower count, and recent activity. All of this evidence runs through our detection rules to assess malicious indicators and make reliable decisions.

It depends on the source. Some detection feeds are real-time — like certstream and asset checks — while most sources run every 45 minutes. We can adjust frequency for platforms you're particularly concerned about.

Malicious domains are blocked across 20+ wallets within minutes of being identified. Browser-level blocking through Google Safe Browsing — reaching Chrome and other browsers — happens within about an hour, with industry-leading acceptance rates.

We integrate directly with MetaMask, Phantom, Coinbase Wallet, WalletConnect, SubWallet, Frontier, Bitski, Argent (now Ready), and many others. Some integrations are direct partnerships, while others reach users through shared blocklist feeds like MetaMask's eth-phishing-detect.

They see a warning screen telling them the destination is potentially malicious. This stops the attack even when the scammer is rotating domains rapidly — which is what makes blocking a critical defense layer that complements takedowns.

Standard phishing domains are typically taken down within 12–24 hours of being flagged. Takedown speed varies by platform and threat type — social media platforms each have their own abuse processes. But because our blocklist stops the threat within minutes, your users are protected while the takedown is in progress.

We handle takedowns across domain registrars and hosting providers, X (Twitter), Telegram, LinkedIn, YouTube, Facebook, Instagram, TikTok, Discord, GitHub, Google Play, the Apple App Store, browser extension stores, and more. If you need takedowns on a platform we don't currently support, let us know and we can prioritize it with our engineering team.

It's your choice. Most customers trust us with fully automated takedowns, but you can disable automation on your account so your team reviews and approves every threat before action is taken. You can also require admin approval for specific asset types — for example, manual review before any Twitter accounts are taken down, while domain takedowns run automatically.

Yes. We monitor Telegram channels and users for malicious behavior, block shared links across wallets and browsers in real time, and pursue takedowns of scam accounts and channels. We also offer Telegram bots that sit in your community channels to auto-detect and remove malicious links, plus advanced honeypotting where our team interacts with scammers to gather evidence for faster takedowns.

We're an off-chain security platform, but we partner with multiple on-chain security teams to keep our customers fully protected. Our focus is stopping threats before users ever interact with them — at the link, the profile, the domain, and the app store.

Wrongly blocking a real asset is something we take seriously, so the protections are layered. We start by allowlisting all of your official domains, social accounts, and assets in your dashboard, and keep that list current as new assets come online. Every detection goes through a thorough investigation and must pass specific thresholds before being approved as malicious — and for edge cases, our human analyst team steps in. If we're ever unsure, we reach out to your team directly via Slack or Telegram before taking action. And if a third party like a wallet or browser vendor ever flags your legitimate site, we monitor for that too and help you get unblocked quickly.

ChainPatrol is a SaaS platform with annual contracts as standard, and pricing scales with your threat volume and the breadth of coverage you need. There are two packages: All-in-One, covering unlimited detection, blocking, takedowns, and triaging across domains and socials; and Enterprise, which adds multi-brand coverage, executive staff monitoring, dedicated reporting managers, 24/7 support, emergency compromise recovery, and custom integrations.

We can run a 1–2 week proof of concept where we deliver a gap report and threat snapshot showing exactly what we'd find and stop for your organization. Since full onboarding takes significant effort from our team, we typically encourage moving straight to contract — and we offer discounting for customers who take that path.

For detection and reviewing, we need your brand assets, keywords, and known impersonation patterns to configure your detection rules. Turning on wallet blocking requires a Customer Information Sheet — your official allowlist of assets. Enabling takedowns requires a signed Letter of Authorization.

Yes. Many customers start with detection and reviewing only — you can enable just those services in your dashboard and add wallet blocking and takedowns later when you're ready.