Catching phishers in their net: This start-up’s 24/7 team scans up to 2 million new websites a day to hunt down crypto brand impersonators

Nikita Varabei once worked at one of those brands, then founded ChainPatrol with his friends Umar Ahmed and Vito Giovannetti. They recognized a need for the service amid confusion surrounding digital currencies like Bitcoin and the newness of crypto technology.

“It’s a little bit of the Wild West,” he told Moneywise. “It doesn’t mean we shouldn’t settle the Wild West. But when you’re on that frontier, there’s bandits and highwaymen and robbers.”

“And snake-oil salesman,” Ahmed added.

Varabei and his teammates are among the hired guns patrolling the frontier, employed by Coinbase, Polymarket, Moonpay and other big brands to track down charlatans, according to their website.

“These companies want to get rid of scammers,” he said. “They’re under attack.”

Varabei wants to stop fraudsters in their digital tracks not only to prevent victim losses, but to restore trust in crypto, which he believes is a truly transformative and empowering technology.

Moneywise talked to Varabei and Ahmed about just what they’re up against.

A David vs. Goliath challenge

Every day, the team must scan the one to two million new websites that launch around the world, filter them down to 500,000 that may be relevant to their clients, and then identify fake ones. It’s a daunting task.

Just two years ago, it would take a criminal up to a week to create an impostor site based on a real brand like Coinbase, PayPal or Booking.com. But impostor sites were flawed, with easy tells like poor spelling and grammar, imperfect images and amateur logos.

Now, thanks to AI, hucksters can do the same job within minutes, producing not just one but multiple clones with different web addresses. Take one down, another goes up. And the sites look more and more professional — evading detection by security researchers.

“We have to be constantly innovating and adapting, just like the scammers,” Varabei said.

The biggest challenge is the scale of the crime syndicates involved. These crime rings operate throughout Asia, the Americas, Africa and Europe. They operate as big businesses and employ thousands of workers to carry out scams 24/7.

How does a small group of software engineers take on such a daunting challenge? They fight fire with fire, leveraging both AI and human intelligence. Their team of 10 in Toronto is bolstered by analysts employed in every time zone who work on investigations around the clock. Ahmed noted that their international colleagues bring both cultural awareness and language skills to the job to identify scams in multiple locations.

When they identify a fake site, they contact platforms around the world to load threat warnings every time someone opens a link to it. That’s a process called blocklisting, and they can make it happen in as little as 15 minutes to immediately reduce the risk.

Ahmed said time is of the essence. Once someone loses money to a cryptocurrency scam, it’s almost impossible to identify the thief or get the funds back. “There’s no undo button for it,” he said.

Once they identify the imposters, they work with search engines, social media apps and web hosts to take them down. That takes longer, because the platforms must be sure they aren’t taking down legitimate sites. The team needs rock-solid evidence.

“Figuring out the right evidence is an art in and of itself, something that we’ve spent years developing and continue to upgrade,” he told Moneywise.