ChainPatrol

Most brand protection providers stop building registrar relationships too soon. They check the box and move on, then struggle with takedown times. I see deep relationships across the industry as the real advantage. You don't build them once. For me, that means showing up to industry gatherings like ICANN conferences and listening when registrars are unhappy. Then working through what's bothering them. Brand protection teams need to collaborate with registrars on requests they're willing to accept. I'm after a high acceptance rate. When enforcement teams treat the hosting provider as an opponent, they make that cooperation harder. The people handling your next request remember how you worked with them on the last one.

Some scam sites never mention the brand name they're copying. No imitation in the domain text or on the page. Just your icon in the browser tab, known as a favicon. We now flag these fake domains by the favicon itself.

Scammers pay for ad space on Facebook to push a fake "wallet security update" or notify users of a “mandatory migration.” 495 of these have been taken down in the past week for just one of our clients. It might look legitimate, but no ad, or update requires your recovery phrase.

We recently saw a very convincing scam impersonating the RCMP. You get a call claiming your name was found on the device of an arrested criminal, and that your credentials are likely at risk. A professional sounding agent calms you down, and says that first they will send you a confirmation email to prove their identity. This of course comes from a fake domain, not the official site itself. The combination of being hit across multiple channels is what get's many people, bypassing the initial wave of suspicion. Your personal information is precious, and examples like this are exactly why it needs to be protected

Don't call a support number just because it showed up first in a Google search. We tracked a scam campaign that got fake hotline numbers ranking on page one using 1000s of throwaway videos all stuffed with phrases like “24/7 Support” and “Account Recovery” to game Google’s SEO. We took down 1,500+ of these fake videos just in the last week.

After 4.3 billion automated rules checked this week, our system ran out of room to count higher. That's the max value a standard integer counter holds. In a single day, we rebuilt the counter architecture to scale for more checks without slowing down our threat monitoring system. On to the next 4 billion.

Ask for customer support on X and a scammer might answer before a real person does. This week we blocked over 2,000 threats aimed at users of the brands we protect. Fake X profiles built to reply under support questions with a link to a “help page.” Look out for this pattern when reaching out to a company for help, because it might be a scammer who gets to you first.

If you’ve already lost crypto to a scam, you're already a target for the fake recovery email. This week a spoofed "Financial Department" email telling people they're owed 1.9 BTC landed in hundreds of inboxes, linking to a lookalike domain. We took down the domain, stopping the attack at the source.