Counterfeit Investigation with OSINT: Sellers and Supply Sources

A counterfeit investigation answers the questions a takedown cannot: whether forty storefronts are forty sellers or one, which company stands behind them, and where the goods are made and shipped from. We map the seller network from open sources, follow the supply chain upstream and help your counsel run test purchases that hold up later.

Email your brief OSINT for brand protection

Seller networks across marketplaces
Supply sources traced upstream
Test purchases with chain of custody
Evidence for counsel and customs

Short answer

A counterfeit investigation uses open sources to link marketplace storefronts, social sellers and web shops to the people and companies behind them, then traces the stock back to wholesalers, factories and shippers. OSINT-S grades each link, supports counsel-approved test purchases with a documented chain of custody and delivers evidence fit for marketplace enforcement, customs applications and civil claims.

What a Counterfeit Investigation Should Answer

Five decisions depend on it: whom to sue, whom to report, what to seize, which marketplaces to press and whether the case is worth the cost.

Your question	What we establish	What it changes
One seller or many?	Shared identifiers across storefronts, shops and social accounts	One coordinated action instead of dozens of separate notices
Who is legally behind it?	Trading names matched to registered companies, directors and addresses	A named defendant for a letter or claim
Where does the stock come from?	Wholesale listings, factory catalogs, shipping origin and forwarders	Enforcement at the source and better customs targeting
How much are they selling?	Listing counts, review volumes, price points and active periods	A damages estimate and a sense of priority
Is anything recoverable?	Assets and payment routes visible from public records	Whether a judgment would be worth enforcing

OSINT on Marketplace Sellers: What Storefronts Give Away

Seller pages, legal disclosures, product images and customer-facing contact details usually overlap across storefronts that pretend to be unrelated.

Counterfeiters spread stock across many storefronts so that one removal costs them little. The storefronts still have to look like businesses, and that leaves records. In the EU, the Digital Services Act requires online marketplaces to collect each trader's name, address, telephone number, email, ID, payment account details and trade register number before the trader can sell to consumers, and to display the contact details and register number to buyers (Regulation (EU) 2022/2065, Article 30). Those public disclosures are a starting point we compare across every storefront in scope.

Disclosed legal details. The same registration number, address or phone number behind differently named shops.
Listing fingerprints. Identical photos with the same flaws, copied description text, matching SKU formats and price ladders.
Lifecycle patterns. Storefronts that open as others close, inherit reviews or reuse a dormant account.
Off-platform traces. The web shops, messaging catalogs and fake social media accounts that push buyers to the same sellers.

Disclosed details can be false, so we test each one against company registers and other records before relying on it. Standalone counterfeit shops are traced through their domains and hosting in a website OSINT investigation.

OSINT Tracing of Counterfeit Supply Sources

We follow the stock upstream through wholesale platforms, factory and trade fair listings, logistics clues and the companies that link them.

Removing retail listings treats the symptom. The OECD and EUIPO estimate that counterfeit and pirated goods made up as much as 4.7% of EU imports in 2021 (OECD and EUIPO, Mapping Global Trade in Fakes 2025), which means most fakes cross a border before they reach a buyer. Upstream work looks for the points where that flow can be interrupted:

Business-to-business wholesale listings offering your product in bulk, often with minimum order quantities and factory photos.
Manufacturer profiles, trade fair exhibitor lists and catalogs that show the same molds, packaging or serial formats.
Shipping labels, return addresses and forwarder names visible in buyer photos, reviews and test purchases.
Company records that connect a retail seller to an exporter, a warehouse or a sister brand. Layered or nominee structures can be unpicked through shell company investigations.

Where your genuine products leak from your own channel, such as overruns or diverted stock, the same methods apply to suppliers and distributors through supplier due diligence.

Lawful Test Purchases in a Counterfeit Investigation

A test purchase turns a listing into physical evidence. It is approved by your counsel, made openly as an ordinary buyer and documented from order to authentication.

Counsel approvalYour counsel confirms that a test purchase is lawful in the seller's and buyer's countries and agrees who will buy, from which listings and with which payment method.
Capture the listingThe listing, seller page and disclosures are preserved with URL, UTC timestamp and SHA-256 hash before the order is placed.
Order as an ordinary buyerNo false identities to obtain private information and no inducement to commit an offense; the buyer simply orders what is offered to the public.
Record the payment and deliveryOrder confirmation, payment descriptor, tracking number, carrier, origin and packaging are recorded, because each can name another party.
Unbox on recordThe parcel is opened on video or with photographs, sealed and logged, so the chain of custody is complete.
AuthenticateYour product experts compare the item with genuine goods; we add the findings to the network map.

Deliverables, Timelines and Limits

A seller network map with graded links, a supply source report, test purchase files and an enforcement plan. Focused cases take from 10 business days.

You receive a register of storefronts and shops with their status, a network map that grades each connection as confirmed, likely or possible, a supply source report, the test purchase files and a recommended enforcement route for each cluster: marketplace action, customs, a cease-and-desist letter or a civil claim. A focused case on one marketplace takes from 10 business days; a network spanning several marketplaces and countries takes up to about a month. Urgent delivery costs 50% more, a senior analyst reviews every report, the quote is fixed after written scoping and the fee goes down if we miss the agreed date. If a judgment needs collecting, the work continues as asset tracing.

We work from public and lawfully obtained information. We do not hack seller accounts, buy leaked marketplace data or pose as wholesalers to extract private details, and we keep personal data to what the case needs under the GDPR and similar laws. We also flag authorized resellers, parallel imports and second-hand sales, which may be lawful. Counterfeit cases are one of the OSINT services for brand owners and IP counsel we run alongside domain and impersonation work.

Find the Source, Not Just the Listing

Send us sample listings, the marketplaces and countries involved and what you want to achieve. We scope the network and supply work and give you a fixed quote.

Email your brief Supply chain risk intelligence

Counterfeit Investigation OSINT FAQ

We see dozens of marketplace storefronts selling fakes of our product at half price — can a counterfeit investigation show whether they are one network before we file more takedown notices?

Usually, yes. We compare the storefronts' disclosed trader details, product photos, description text, SKU formats, contact numbers, return addresses and opening dates, then check the details against company registers. When several shops share a registration number, a phone or the same photo flaws, they are almost certainly one operation. You get a graded map, so you can act against the network in one coordinated step.

Our counsel wants physical evidence for a lawsuit against a counterfeit seller — how do test purchases work, and who should actually place the order?

Your counsel decides whether a test purchase is lawful in the countries involved and who places it, often an investigator or a member of the legal team buying openly as an ordinary customer. We capture the listing first, record the order, payment, tracking and packaging, and document the unboxing. Your product experts authenticate the item. That chain of custody is what makes the purchase usable in court.

The counterfeit sellers we've found all list addresses abroad that look fake — can OSINT find out where the goods are actually made and shipped from?

Often it can narrow it down. Wholesale listings offering your product in bulk, factory catalogs, trade fair exhibitor lists, shipping labels in buyer photos and forwarder names on parcels all point upstream. We match those to company records. Not every case reaches a named factory, and we state the confidence for each link, but even a confirmed exporter or forwarder gives customs and counsel something to act on.

Some of the sellers we suspect might be selling genuine stock bought cheaply elsewhere — how do you avoid accusing a legitimate reseller of selling counterfeits?

We classify before anyone is accused. Indicators such as impossible prices, wrong packaging, copied photos from your own site and links to known counterfeit suppliers point one way; a business history, invoices from authorized channels or genuine serial formats point the other. Parallel imports and second-hand sales may be lawful depending on the market. A test purchase and your own authentication settle doubtful cases.

We're a mid-size brand with a limited budget — is a full counterfeit investigation worth it, or should we just keep reporting listings to the marketplaces?

Keep reporting low-volume, scattered listings; that is cheap and often enough. An investigation pays off when the same sellers keep returning, when volumes suggest real losses, or when you need a named defendant or a customs application. A focused case on one marketplace takes from 10 business days, and the scoping call tells you whether the evidence is likely to support the action you have in mind.

Can you shut down counterfeit storefronts for us directly, or do we still need to file the marketplace complaints and legal claims ourselves?

Marketplaces, customs and courts make those decisions, and most marketplace programs accept complaints only from the rights holder or its representative. We prepare the evidence pack for each route, organized the way each marketplace asks for it, and your team or counsel files. Network-level evidence usually gets better results than single-listing notices, because the marketplace can see that the accounts belong together.

Sources and Notes

Sources checked 10 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.