Brand Protection 2026: Monitor Counterfeit Sellers Undetected

The storefront looked completely legitimate. Authorized-dealer badge. Proper product photography. Descriptions that matched the manufacturer's catalog word for word. Three visits later — still clean. No obvious counterfeits. No trademark violations. Nothing to report.

Then we spun up a fresh browser profile with a new fingerprint and a different residential proxy. Same seller. Same listings. But now the product images showed knockoff packaging. The prices dropped 60%. And the "authorized dealer" badge was nowhere in sight.

Seller cloaking. I'd heard about it for years. Finally saw it myself. Felt a bit dumb, honestly — how many investigations had I run before this where I was just seeing the clean version and not realizing it?

Brand-protection teams run into this constantly. Counterfeit sellers aren't stupid — they know investigators exist, and they know how to detect them. The moment your fingerprint shows up too often, or your browsing pattern looks like monitoring instead of shopping, you start seeing the sanitized version of their store. The fakes disappear. The evidence you need? Gone.

This is why brand-protection teams are quietly adopting antidetect browsers. Not for multi-account management or affiliate marketing (the usual use cases). For investigation work. To see what actual customers see instead of what sellers want investigators to see.

The Problem: Seller Cloaking Is Smarter Than You Think

When most people picture counterfeit sellers, they imagine sketchy listings with obvious tells — bad grammar, stolen product photos, prices too good to be true. And sure, those exist. But the sophisticated operators? They're running fingerprint detection, behavioral analytics, and dynamic content serving.

Here's what that looks like in practice.

A seller sets up shop on a marketplace. They list counterfeit goods — luxury watches, designer accessories, electronics with fake certifications, whatever. But they also run detection scripts. When a visitor arrives, the script checks:

Browser fingerprint (canvas, WebGL, audio, fonts)
IP reputation and geolocation
Session behavior (time on page, scroll patterns, click sequences)
Visit history (have they seen this listing before?)

If the visitor looks like a normal customer — first visit, residential IP, consistent fingerprint, browsing multiple listings — they see the real inventory. Counterfeits. Low prices. The whole operation.

If the visitor looks like an investigator — repeat visits, datacenter IP, inconsistent fingerprint, only viewing specific product categories — they see a different storefront. Legitimate products. Proper pricing. Nothing actionable.

The cloaking happens server-side. Same URL, different content. Your screenshots show a clean store because that's what the server sent you. Meanwhile, actual customers in the same market see counterfeits and buy them.

I've talked to brand-protection consultants who spent weeks building cases against sellers, only to have legal dismiss the evidence because it didn't match what the seller's public storefront showed during discovery. The seller just served clean content to the lawyers too. Without technical proof that cloaking occurred, the case stalled.

Infuriating. All that work, and the bad actor walks because their server was smarter than the investigation methodology.

Why The Obvious Approaches Fail

The first instinct is usually "just use a VPN." Different IP, different location, problem solved.

Except it's not. VPNs change your IP address. That's it. Your browser fingerprint — the canvas hash, WebGL renderer, font stack, screen resolution, installed plugins, timezone, language — stays exactly the same across every VPN connection. Sophisticated sellers track fingerprints, not just IPs. Five visits from five different VPN servers with the same fingerprint? That's clearly one person trying to hide, not five separate customers.

The second instinct is "use incognito mode." Fresh session, no cookies, clean slate.

Also insufficient. Incognito clears cookies and local storage. It doesn't change your fingerprint. Canvas rendering produces the same hash in incognito. WebGL reports the same GPU. Your font list is identical. Detection systems see through incognito trivially.

The third approach — and this one's more reasonable — is "use different devices." Laptop for one investigation, phone for another, tablet for a third. Different hardware, different fingerprints.

This actually works. But it doesn't scale. Brand-protection teams monitoring hundreds of sellers across dozens of marketplaces can't maintain separate physical devices for each investigation thread. The logistics become absurd. (I briefly tried the "dedicated devices" approach. I had three laptops, a tablet, and two phones on my desk. My coworkers thought I was running a resale operation. It lasted two weeks before I gave up and started looking for software solutions.)

And you still have the IP problem if all devices share the same network.

The fundamental issue: investigation work requires appearing as multiple independent visitors when you're actually one person conducting systematic research. That's exactly what fingerprint-based detection is designed to catch.

The Workflow That Works

Let me walk through how this actually looks in practice. I'm describing a composite workflow based on how brand-protection teams approach this problem — not a specific customer story (we're pre-revenue), but the operational pattern that makes sense.

Profile Architecture

The first step is creating a profile structure that supports investigation at scale.

Base profiles by target market:

US East (residential proxy, US timezone, English fonts)
US West (same, Pacific timezone)
EU major markets (UK, DE, FR — each with appropriate locale)
APAC if relevant (JP, AU, SG)

Each base profile gets a unique, internally consistent fingerprint. Canvas, WebGL, audio, fonts, screen resolution — all matching what a real device in that market would report. JustBrowser handles this automatically when you create a profile and assign it a locale.

Investigation profiles per seller:

For each seller you're monitoring, clone the appropriate base profile and assign it specifically to that target. Never reuse investigation profiles across multiple sellers. If Seller A detects your fingerprint and starts cloaking, that burned profile shouldn't contaminate your investigation of Seller B.

Naming convention matters when you're managing 50+ profiles. Something like INV-[MARKET]-[SELLER-ID]-[DATE] — for example, INV-US-EAST-AMZN-3847592-JUN26. Searchability saves time.

Proxy Configuration

Every profile needs a residential proxy matching its claimed geography. Datacenter IPs are flagged instantly by any serious detection system. Mobile IPs are even better (carriers have more trust) but cost 3-4x more per GB.

For marketplace investigations specifically:

Amazon: residential proxies work, mobile preferred for high-stakes monitoring
eBay: residential is fine, less aggressive detection
Alibaba/AliExpress: residential required, some seller-level cloaking also checks IP reputation scores
Independent e-commerce sites: varies wildly, test each target

Sticky sessions matter. You want the same IP throughout an investigation session, not rotation. A visitor whose IP changes mid-session looks like a proxy, not a person.

Current pricing for residential proxy bandwidth: Bright Data ~$8.40/GB, Smartproxy ~$7/GB, IPRoyal $5.50-7/GB. Budget around 100-300 MB per investigation session depending on how many listings you're documenting. Yeah, proxy costs add up. It's annoying. But it's cheaper than losing a legal case because your evidence got thrown out.

The Investigation Session

With profiles and proxies configured, here's the actual workflow for investigating a suspected counterfeiter.

1. Launch a fresh profile.

If you've investigated this seller before with a different profile, use a new one. Burned profiles stay burned. Boot the profile, verify the proxy is connected (check your IP and location), and make sure the fingerprint passes basic checks. JustBrowser has a built-in detection page (18 vectors across 4 groups) — run it before you start, and spot-check externally on CreepJS or BrowserLeaks.

2. Warm up with organic browsing.

Don't go straight to the seller's page. Spend 3-5 minutes browsing normally:

Load the marketplace homepage
Search for related (but different) products
Click a few unrelated listings
Maybe add something innocent to cart

This builds session history that looks like actual shopping behavior, not surveillance. Sellers with behavioral analytics watch for patterns like "arrived at store directly, viewed only one category, never clicked reviews." Real customers don't browse that way. I know it feels like wasted time. Do it anyway.

3. Approach the target naturally.

Search for the product category you're investigating. Let the seller's listings appear in search results organically. Click through as if you're a customer comparing options. View multiple listings, not just the suspected counterfeits.

4. Document everything.

Screenshot every page: product listings, seller profile, shipping information, return policy, customer reviews. Include timestamps in your documentation.

For evidence that holds up:

Record the profile's fingerprint configuration (JustBrowser can validate it via the profile panel or GET /profiles/{id}/fingerprint/validate, and the full profile can be exported encrypted)
Record the proxy IP and geolocation
Save cookies and local storage (can prove session continuity)
Note the browser version and OS reported in the fingerprint

This metadata establishes chain of custody. When legal asks "how do we know this screenshot wasn't fabricated," you can demonstrate it came from a specific technical configuration at a specific time.

5. Check for cloaking.

After documenting, close the profile. Wait 10-15 minutes. Then launch a different profile with a different fingerprint and different proxy from the same market. Visit the same seller. Compare what you see.

If the listings differ — different products, different prices, missing badges — you've detected cloaking. Document both versions. The delta between what two "customers" see is often the most compelling evidence.

6. Archive and rotate.

Save your documentation. Flag the used profiles as burned for this seller. Create new investigation profiles for follow-up visits.

Scaling the Workflow

For teams monitoring dozens or hundreds of sellers, manual investigation doesn't scale. But the core approach does — you just automate it.

JustBrowser's REST API lets you spin up profiles programmatically. Call the API to launch a profile, receive a CDP WebSocket endpoint, connect Playwright or Puppeteer, run automated evidence collection, and close the profile. Same stealth benefits as manual investigation, but scriptable.

For scraping-adjacent use cases like this, check out our web scraping at scale guide — the architecture is similar, just applied to investigation instead of data extraction.

Teams doing this at scale typically:

Maintain a pool of pre-warmed profiles per market (rotated weekly)
Run automated collection against known bad actors nightly
Flag deltas for human review (something changed, might be cloaking)
Escalate confirmed cloaking cases for deeper investigation

The automation handles volume. Humans handle judgment calls. (And humans get credit when the case wins. That part matters too.)

What This Looks Like in Practice

A sportswear brand suspects a seller on Amazon is listing counterfeit jerseys. The listings look legitimate — proper photos, reasonable prices, seller has 4.2 stars. But customer complaints are coming in about quality issues, and some units tested as fakes.

Week 1: Initial recon with fresh profiles. US-East residential proxy, Windows 11 Chrome fingerprint. Browse the seller's store naturally. Document listings, prices, product descriptions, images. Everything looks clean. Proper branding.

Week 2: Same approach, different profiles. US-West, macOS (Apple Silicon) Chrome fingerprint. Compare to Week 1 documentation. Listings are identical.

Week 3: Expand the investigation. Create profiles with different behavioral patterns — some with empty histories (new customers), some with sports merchandise browsing history (target demographic), some with cart activity on competitor products.

Here's where it gets interesting. The "new customer" profiles with empty histories see different listings. Lower prices. Images that show clearly non-authentic packaging. The "warm" profiles that look like returning investigators see the clean versions.

That delta is evidence. Document both versions. Pass to legal with full technical metadata.

Here's my unpopular opinion: sellers who cloak are actually doing you a favor. They're proving intent. A seller who accidentally listed counterfeits might have a defense. A seller running server-side fingerprint detection and serving different content to different visitors? That's premeditated. Makes the legal case stronger, not weaker.

Winning this game requires not looking like you're playing it.

Integration Points

Brand protection doesn't exist in isolation. A few integration patterns that make sense:

For click fraud crossover: Teams protecting brands from counterfeits often also deal with competitor click fraud — fake clicks on your ads from competitors or bot networks. ClickzProtect handles the click fraud prevention side. Some operators run both simultaneously: antidetect for marketplace investigation, fraud detection for paid media.

For tracking investigation metrics: If you're running dozens of investigations monthly, tracking them manually gets messy. Spreadsheets work until they don't — and they usually stop working right when you need historical data for a legal filing. JustAnalytics can help log investigation sessions, success rates, and evidence collection metrics without sending data to third parties.

For ad verification crossover: The same cloaking problem affects ad verification — publishers serving clean content to verification bots, sketchy content to users. We covered that workflow in the ad verification guide. The profile architecture and fingerprint principles transfer directly.

Frequently Asked Questions

Why do counterfeit sellers serve clean storefronts to investigators?

Seller cloaking works because repeat visits from the same browser fingerprint signal an investigator, not a customer. Customers browse once, maybe twice, then buy or leave. Someone loading the same listings 15 times from the same canvas hash and WebGL renderer is clearly monitoring. Sellers detect this pattern and serve a sanitized version of their store — real products, proper descriptions, no trademark violations. The fakes only appear for fingerprints they haven't seen before.

Can I use a VPN instead of an antidetect browser for brand protection?

VPNs change your IP but not your browser fingerprint. If you check the same seller from five different VPN servers, your canvas fingerprint, WebGL renderer, font list, and screen resolution stay identical across all five visits. Sophisticated sellers track these parameters. You'll see the same cloaked storefront from every VPN exit node because the fingerprint identifies you as the same person.

How often should brand-protection teams rotate browser profiles?

For high-risk sellers, use a fresh profile for every investigation session — one profile per seller per day maximum. For routine monitoring of lower-risk targets, weekly rotation is usually sufficient. The key is never reusing a profile that's already been flagged. If a seller suddenly serves you a clean storefront when you previously saw counterfeits, that profile is burned.

What evidence should I capture during counterfeit investigations?

Screenshot everything with timestamps: product listings, seller information, shipping details, customer reviews, and the checkout flow. Record the profile configuration you used (fingerprint hash, proxy GEO, browser version). Export browser cookies and local storage. For legal proceedings, this metadata proves the evidence came from a specific technical configuration at a specific time, making it harder for sellers to claim the screenshots were fabricated.

Try JustBrowser

Native Chromium antidetect browser — not extension-based. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer, so 40+ identity parameters are genuine, not faked. REST API for Playwright, Puppeteer, Selenium. $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles.

Get started → · How it differs from Multilogin / GoLogin / AdsPower