Counterfeit goods aren’t a new problem. But they’re one, like many things, that has grown exponentially with the size and access of the internet. Listings appear on online marketplaces, with your branding, your product and suspiciously good prices. They actually ship the product too, though what customers get are shoddy knock-offs that don’t perform as expected, failing early and often. But as the counterfeit operations are so good, the blame inevitably falls on your brand. Not the counterfeiter.

These days, these operations run on the big digital marketplaces, instead of back-alley flea markets. And the traditional recourse to you has been to report them, and have the listing taken down. You spot it, file a report, the marketplace agrees with you, and it’s gone. Sure, you may have to repeat the process on a few marketplaces, but enforcement happens. Until now.

Now the same product shows up somewhere else. It’ll have a different seller name, with the same photos and same product description, but instead of being on a marketplace, it’s on a website you’ve never heard of. One with an ad sitting above your own search results.

That’s what we’re talking about today: how counterfeit sellers have developed their own marketing funnels, with multiple points of contact to get people to buy their dummy products, and how it’s grown beyond just a listing in an online store. It’s websites, ads, social accounts, and, in particular, the part counterfeiters care about most and brands tend to overlook: the counterfeit domain.

The marketplace enforcement paradox

Let’s start with some good news, because there is some. Marketplaces have gotten much better at handling counterfeits. If you’ve been doing brand protection for a while, you’ll remember when reporting a fake listing felt like sticking a letter into a bottle and hurling it into the sea, hoping it’ll find help. It doesn’t feel like that now. It actually works.

Sadly, it only works inside its own digital walls. A marketplace can pull a listing and suspend an account, but what it can’t do is shut down the business behind them. The person running that account still has product supply, photography, logistics and a need to find customers. None of that gets deleted with the listing.

Which leads to a slightly awkward situation. As marketplace enforcement gets better, counterfeit sellers have spread their efforts across more channels, because the one they relied on is now more hostile to them. They have to find new ways to sell “their” product. And that means, among other things, their own websites.

The better enforcement is, the more creative the counterfeiters have to be. This isn’t a contradiction. Businesses, even illegal ones, adapt.

From counterfeit websites to a counterfeit ecosystem

Counterfeit businesses do most of the same things legit ones do. In a way, they have to, because they want to appear legit to buyers, who are used to seeing online businesses acting in certain ways.

That means, in addition to having listings on marketplaces like Amazon, they’ll have their own websites they can link to. These will have a different domain name to your own, but one that is still either plausible or enough of a lookalike to pass. Often, these websites don’t even take any effort from them. They just copy and paste your own, pointing the links to their own payment backends.

They’ll also do all the marketing that you’re doing – though always with a hard-sell slant, pushing to their discounted product. They’ll let you do the brand work. All the counterfeiter has to do is tell people that the product is 60% off. They do this through paid search ads targeting your website, Instagram accounts copying your own content, and content creators happy to take any money to push a deal.

And just like your own brand, it works to be across different channels to make it seem more authentic; more trustworthy. It’s a marketing campaign driving a sales funnel running parallel to your own, siphoning buyers away from you, but not protecting you from the reputational damage that happens when those fake products show up.

Why the counterfeit domain matters more than the listing

These interconnected branches of the counterfeiter ecosystem give us an avenue to attack them. Previously, you could really only go after the marketplace listing, which could become something of an endless task. But marketplaces have grown better at keeping the repeat offenders out, which is why they moved to their own domains.

On a domain they own, nobody sits between the counterfeiter and the customer. There’s no account to suspend, no rating to lose and no policy to break. They control the whole journey, from the ad click to the checkout. They can use payment gateways that put the money straight in their own pocket, without any of the protections that customers are used to. And that’s if they’re just focused on selling knock-off items. They can, of course, do much worse.

The best part for them: a domain costs them less than a sandwich. If it gets taken down, a replacement can be live within hours, with the same template and the same product catalog dropped on top. All they have to do is update their links.

All that being said, everything that makes the domain useful to a counterfeiter also makes it useful to us. All the details we track when looking for brand abuse patterns at a strategic level apply to counterfeit domains too. Registration timing and patterns, registrars used, and the like give us information that we can use to take them down for longer. Because nothing feels worse than knocking down one website just for another to appear the next day.

The whack-a-mole problem with counterfeit websites

The ease with which counterfeit goods websites can jump from one domain to another is part of the plan they’re using. Security Research Labs looked into one counterfeit operation, which they nicknamed BogusBazaar, and found tens of thousands of fake store domains run on something close to a franchise model. A small core team maintains the software, servers and payment plumbing, and a wider group of operators spin up stores on top of it. It means that taking down one store is, to that network, a minor inconvenience.

That means that the whack-a-mole of chasing counterfeit websites is exactly what it feels like: futile. At least if you’re pointing your enforcement at that surface level: hitting the storefronts and not the thing that builds them. You have to take a more holistic view of enforcement, and try to take them out from the roots.

Detecting counterfeits

That doesn’t mean you should stop smacking down those storefronts. They’re still doing damage to your customers, and through them your brand. Thankfully, as we said, the same processes that work with brand monitoring are at play here (because, in the end, this is brand monitoring – just focused on one particular type of abuse.)

Still, if the counterfeiter is working a funnel, your counterfeit monitoring needs to cover the funnel. In practice, that means:

• Domains and DNS. New registrations, aged domains changing hands, lookalike domain monitoring, and what those domains are actually doing: mail records, certificates, live checkouts.

• Marketplaces. Despite the expansion of their footprint, they’re still active here.

• Paid search and shopping ads. This can be the clearest sign that somebody is spending money to attack your customers.

• Social media. Cloned profiles, scraped product photos, bio links and DM funnels that lead off-platform. Social media monitoring catches these operations.

• Content. Your product photography, copy and even your returns policy turning up on sites that aren’t yours. Content monitoring is also one of the best ways to find a store that didn’t use your brand name in its domain.

• Search results. Fake stores also compete on SEO, as well as through ads.

That can lead to a lot of hits, so it’s important to have a solid validation framework in place to avoid alert fatigue in brand protection. This will help you cut down on the number of unimportant warnings, and also help you make the connections required to spot the serious counterfeiter rings.

For instance, in another network researchers looked at, the thread tying 20,000 fake shops together wasn’t the products or the branding, it was a leftover browser tab title, reused on every single site. Rapidly reusing infrastructure leaves marks like that everywhere. You just have to be looking for the operation rather than the website, which is the difference between a list of alerts and proper brand monitoring.

What you should do to handle counterfeiter operations

Dealing with these counterfeits isn’t easy, and it isn’t a one-and-done project. It’s constant monitoring, investigating, and enforcement. But the broad cycle looks like this:

Detect: Watch the channels above continuously. You don’t want to take a two week break just as another wave of fake stores pop up.

Validate: Work out whether a hit is a threat or a distraction. Is it live, is it selling, and is it reaching customers?

Connect: Find out what the threat shares with everything else you’re seeing. Hosting, templates, payment endpoints or registration patterns. You want to take down operations, not individual storefronts.

Prioritize: Sort by exposure, not volume. One fake store with ad spend behind it is a bigger problem than ten that no one visits.

Disrupt: This is what matters. Removing the threat. Our takedown services exist for exactly this stretch of the process, with additional analysis and enforcement for the cases that need more than a simple notice.

Monitor again: This doesn’t mean start again (though do that too), it means watching the operator you’ve just identified, because the fastest way to catch domain B is to already know who registered domain A.

Once you’ve got this loop going, you’re not only going to be better protecting your brand, you’re also going to have a better idea of how much risk it’s exposed to. You’re going to be able to see how many counterfeit attempts there are, but also – and maybe more importantly – factors like time to detection, or takedown. You should be able to work out how many customers are seeing these operations, and hopefully drive this number down.

Counterfeit protection starts with the domain

One of the good pieces of news, especially when considering how prolific these networks can be, is that they have to operate to a pattern. They’re copying you. And so as you get better at spotting them, you’ll get better at cutting them down before they can do much damage, and make the effort they’re putting in to copy you pay off less and less.

It’s whack-a-mole, but eventually, the moles go digging somewhere else.

Counterfeit protection today means watching the wider web, connecting what you find, prioritizing what’s actually reaching your customers, and taking it down fast. That’s what BrandShelter does, from domain monitoring and brand monitoring, through to takedowns and enforcement. We’re here to help you keep your brand, your customers and your reputation in good health.

Share article