DIY Brand Protection for Web3 Startups | Nikita Varabei - ChainPatrol

[Music] all right hello everybody thanks for coming to this talk uh I'm Nikita I'm the co-founder and CEO of chain Patrol and today I'll be talking to you about do-it-yourself brand protection for web 3 startups so essentially this is actually something our company does but this is something all of you can do eles to help protect your users from impersonation from fishing attacks and from fake airdrops now to start off in just last year there was over 600 million lost due to impersonation and fishing attacks think about all the fake airdrops you see on Twitter all the fake Google ads uh scammers in your Discord this is all something that's targeting your community and so so this is something that you need to be very much aware of whether you're a large project a small project scammers are targeting your community they're impersonating your brand they're cloning your website they are making copies of your Founders profiles reaching out to your users to your community and trying to trick them to go into a wallet draining website this is something that happens very commonly I'm sure a lot of people here already got hit or know somebody that's gotten hit by one of these but really what these scammers are going for for is they're trying to steal your seed phrase they're trying to get you to sign a malicious transaction or otherwise install malware on your computer that then steals all your funds now projects of all sizes are being targeted well we're seeing here that it's not just like the really big ones the big l2s you know the big the companies that everybody knows it's even we're seeing that even small projects with only maybe like 5K followers on Twitter with just starting off with their with their basically building up their Community they're already getting targeted they're getting clones of their Twitter site Twitter account they're getting clones of their um of the of their users on Discord and basically scammers are trying to Target your users to steal funds from them and so what can we do about this like what can you as somebody that's running starting a new project or running a big Community what can you do to actually protect your users so first step is track all of your digital assets so before we can do all this stuff of how do we find the scammers how do we get rid of them how do we protect our users you need to take an inventory of what is going on with your digital footprint so you want to take a look at everything from your visuals have a good sense of your brand kit your your obviously company name your logos all your brand colors this is all going to be important for various forms of detection that you can run keep track of all of your high-profile people like obviously the founders but employees ambassadors uh also like any Devils this is especially important because devs get impersonated heavily in the space uh know what digital platforms you're heavily present on for everybody in crypto that's probably just like your domains and your Twitter profile but also know that if you're if you have a presence on like Tik Tok YouTube other places scammers are all over these platforms impersonating your brand and the last part is like any kind of like vendors you're working with Partners some somebody that you know you might have launched a campaign with we for example have seen have seen uh places where people are launching with deform and then the deform is getting impersonated by targeting another brand right and so we've actually worked with them to help in in this case as well so now you've taken inventory of everything you have uh your all all your brand kit all of your official domains keep track of your Park domains too and now let's go into threat detection so how can you find these impersonations before they hit your users so to detect threats early there's a couple things as a crypto kind of startup you really want to focus on you want to look at domains your X account and Google ads these are like the top three there's also scammers in your Discord but there's a little bit of a different uh solution for that so uh for domains you need to keep track of what are your official domains uh what are all the X accounts I highly recommend that if you can use the Affiliated feature make make sure all of your team team members are officially Affiliated to your main account this helps a lot with determining who's an impersonator or who is real and then monitor Google ads just basically go and search for your brand like a regular user search your own company's name on Twitter search your Founders names on Twitter uh search yourself on Google Search and other engines and see what comes up you might be surprised to see hey there's an ad here that's above my company name leading to a wallet draining website and and if you find this okay what we need to do now you need to do something about this so the core is really search for this like a regular user across platforms and then there's some Advanced tools that I'm about to dive into that can take you a step further being URL scan DNS TST DNS twist and also iok rules as well that we can look into so the very first one this one's like super simple to use DNS twist you put in your domain name it finds all the kind of permutations that are kind of similar somebody places a letter somebody adds some words uh and basically somebody might try to like adjust how your domain is spelled for example here I just put a Unis swap. org it found me some a bunch of these this is just like the start of the scan you can see there's like 3,400 results here uh and it actually goes ahead and tries to find you like is the site live where is it registered it try it doesn't just like you know uh blindly just throw a bunch of letters and numbers in there it actually tries to find things that are similar to your domain and do some basic checks of like is there a response is there liveness saves you a lot of trouble uh you can see some of these already coming up and actually what I noticed was these are actually block listed uh by a lot of the major uh by a lot of my major security providers out there which is great then uh you want to look at URL scan next URL scan a bit more advanced you need to learn how to use it but it's also not that complicated so basically what it does is full scanning of domains tons of companies from security companies to like individual brands use this to find uh different basically you can just put in there any website it'll scan it take a screenshot grab all the code uh that's in the website and kind of store it and this is very useful because you can see what are the contents of the site you don't actually have to navigate if you suspect there's malware there or some other issues it can scan the site for you and then when you scan a site especially if you want scan your own site viewers can actually build up a graph of visual similarity and of um code similarity across the whole across all scans that it's run so for example here somebody's like scanning uh Netflix and actually finds all the websites that look like Netflix that have been scanned across this platform and this is important for you because you know you don't have the time to go and search for all the different domains that might be similar to yours and this is what scammers do a lot they will often go ahead they'll clone your entire website host it on a new domain add Das air drop in the name and uh basically send it email it out to all your users what this does is if anybody scan that domain if anybody scans similar domains anything that looks like your website will show up in these results and this can be very quick way of finding what is uh impersonating your your site and trying to Target your users H now this is like in terms of domains so let's go into a bit of like X or Twitter detection so in this case there's just a couple things you want to do right start it's very pretty fairly simple things but they can go a very long way just look for your brand name and then airdrop you know like arbitr my airdrop optimism airdrop these things happened way long ago but there's still scams trying to impersonate these different orgs right and even if you're even if you're a small uh company if there's any news around you of you might be doing a tge or an airdrop or going to testnet these are all events that are targeting your org start searching for this even if there's rumors out there this might be happening because you know the scammers act on these based on these rumors so look for things like your brand name airdrop your brand name claim look for the ticker symbols if you have a coin or anything else often times the scammers will look will be like oh this like Stark you know strk like airdrop going on and then that's what they will uh use to Target your organization look for hashtags including your name and this kind of stuff very quick like 10 20 minutes to search and you can find a bunch of impersonations we'll go into what to do about them in a moment last thing is this is a big one Google search and ads everybody like I hope everybody like most people have ad blockers but if you don't and there's a lot of people who don't uh you will get hit by these right and so um basically scammers can take out ads against your company somebody will search your company name and the first result they see will be a scammer uh a scammer site you go there it looks exactly like your website it drains it drains the user's wallet um and so again search for both the common terms like brand airdrop brand login claim but also the this is something not many people know is uh Google search actually has a very like in-depth query language you can use and so for example we've seen a lot of scammers use uh popular hosting sites to uh create like thousands and thousands of fake Pages there's stuff like web flow getbook um teachable uh they get a they get abused for this a lot uh and so what you can do is to type something like here we have this site. star. wef flow.io and then you can say in the title is your brand and it's going to find all the webflow sites that have your Brand's name somewhere in the title and this can help you actually automatically find all the impersonators if they're using all these platforms the big ones to look out for are like web flow getbook teachable uh and and uh GoDaddy sites as well those get abused quite a bit uh yeah so let's keep let's keep going so okay so you found a bunch of scams you found all these impersonators like what do you what do you do about this now so two things first one takedowns this is where you need to go to the hosting provider and let them know hey like this is impersonating me get rid of this if you have trademarks this is ideal to have trademarks or any sort of like company like formation documents and just anything can that can prove that you actually own this like brand is very very helpful uh a lot of Hosting providers will just do it out of the bat other ones are more stringent and other ones are you really got to push them to get them to to take something down uh but a lot of them are are quite compliant and so you can go to their hosting providers and use their abuse emails or their forms to take them down and there's actually a very useful tool here fish.

report you can actually go there they have just a uh search where you can put in any website and it'll let you know where is it being hosted and where to submit the abuse report and so it makes it makes all this stuff uh much simpler to do now uh for Block listing so takedowns can take a while so takedowns can take anywhere between you know 5 to 8 hours if it's like doing amazing to like a week to a month to potentially never if it's a non-compliant uh hosting provider or DNS registar and so this is where block listing comes in this is something that exists in both a traditional web2 space but it's also grown a lot in the web 3 uh in the web 3 space as well where essentially there's a bunch of different organizations users and we all collaborate together there's ASA chain Patrol there's seal also known as the security Alliance uh there's the effici attack built by metamask we're actually all contributing to one major block list of malicious domains that goes out to all the major wallets out there like metam Mass Phantom coinbase wallet like a whole bunch of others there's a block list that goes out all out there and there's T there's people on our team there's people at metamask there's people at seal that are all actively looking at these submissions for these domains so you can go and basically report these uh you can go on the effici detect repo you can also just go to like chain patrol. iport you have a scam link paste it in there we'll handle it for you right we this is something that we we do across the across the whole e system is basically just finding scams reviewing them getting them block listed and ensuring zero false positives and so now the wider block list is there's also Google safe browsing Google safe browsing is embedded into Chrome Edge Firefox all the major all the major um Safari and others all the major browsers out there this is harder to land on their block list they do a lot more checking it takes a bit longer but you can report to them as well they have a report site here and then like when it lands on that block list like nobody on the internet can access that site anymore and that's great for that's great for uh protecting your users because it's important to make sure that they know that hey this is a fishing site there's going to be a big red warning on the site when you visit it and it's going to help protect your users from these attacks here's an example of the warning you might see if you have metamask installed and you visit one of these uh sites on the block list you'll just see that this site website might be harmful you know it's deceptive that you don't touch it you can still proceed we also have a process for disputing these if anytime like there are very very rare cases of false positives you can report them to us as well we like within a couple of minutes we'll respond to you and get the site unblocked as well that's a big part of this whole block listing solution is that the goal is to stop scammers and not to uh impact uh you know legitimate projects in the space and this is a coordination of seal and a whole bunch of teams across the ecosystem so that's really the two main things that you can do like immediately you found a scam you go take it down you go take it down and you get it block listed now as you see this once you've become a Target the scammers aren't going to be like oh well one one thing got taken down we're done you know we're moving on typically if you have a lot of hype around your project or you have a quickly growing Community the scammers know that as well they're very dialed in into what projects have a lot of eyes on them and they know that's perfectly the place for them to deploy their impersonations so you need to monitor consistently again URL Scan they actually have an alerts feature as well yeah once you have a search query that you see shows up uh shows you a lot of impersonations you can actually set an alert for it you'll get emails whenever there's a uh something new pops up on that search so you know that hey this there there's something for me to look at here um create a sheet just track these have somewhere where you have a like even ve basic like just a of the sites did you do a take down did you blocklist it uh some of these hosting providers they really require follow-ups for them to actually remove anything um and then understand the impact on your community just be aware like did somebody in your community get hit by these have a way for the community to connect to you and basically like reach out and offer them help offer them some guidance there's us and seal and others have lots of great guides on like what to do if you did get hit by one of these how to secure your wallet if it's still in a secure able State and you didn't give up your seed phrase if you gave up your seed phrase you're done uh there's not really much that can be done outside of like maybe some freezing and recovery at that point uh but there's things that we can do to help right and so monitor these attacks understand the impact and then see how you can help out your community uh part of this is building a clear source of Truth this is very important a lot of projects do this but I'm still constantly finding others that don't uh is have your have places where your community can go to find the official links have it inserted into your docs have your Discord have an official links channel right at the top that nobody can type in right just some of these basic things will help a lot for users to double check and make sure that they're interacting with the right site uh and then we've got um so the dedicate channels and also get your stuff allow listed actually uh us and C efficient Tech others we all collaborate on kind of like a mega allow list of legitimate domains in the space and this helps with catching scammers faster and verifying legitimate projects as well uh this helps significantly uh with like all the security work that goes on behind the scenes in the crypto space and the final thing is it just involve your community right you're you're part of the solution like you as the leader of a project as the person building this is you're I think it's the responsibility of all the projects to like do something to protect their Community find these scams help uh help take them down but your community members actually hate the scammers themselves and they don't like them they don't want they don't want them to thrive and they want to get rid of them so essentially when like no one likes scammers and your community can help you can create a scam report channel in your Discord Drive users there let them know like hey like if you see a scam just report out there have it as part of like your Discord on boarding uh and then have your mods monitoring that and then have them trained on like what do you do when a user does report a scam what what happens if I see a scam on Twitter how do I take it down if I see a fake domain how do I blocklist it like have like just a process for uh what to do in this case because a lot of times those reports come in and people don't really know what to do about them and if you just make an easy flow for this it it's it becomes much uh much more straightforward and you'll see a lot less losses in your community uh and there's lots of bots there's like Wick there's others that are great uh there's like Sledgehammer there's hash bot um and our own chain Patrol bot as well they all Ser of a bit of a different Ser different uh um focuses but there's things that can gate scammers from entering your Discord that can check for impersonations of your team members your mods and your admins they do like comparisons on on the profile pictures and the usernames you can put certain uh you know words like oh you can't mention like an airdrop about us because we don't have an airdrop going on and just some basic stuff like this will go a long way to prevent your users from getting scammed uh yeah so that's that's essentially it uh thank you everyone I hope you learned something about how to keep your community safe I think it's immensely important we're going to have lots of people this year in the coming years coming that are completely fresh and we need to protect them we need to the best way to grow crypto is to make people feel like they're safe they can transact and that there's really no uh you know that they can feel safe in this in this new e system thank you