Proxies for Brand Protection: Finding Listings Hidden From You

Counterfeit listings and unauthorised resellers are not hidden. They are targeted — shown to the buyers they want and withheld from everyone else, including you. That is why a brand protection sweep run from one office IP finds so little: the infringing listing is deliberately not being shown to the address that keeps looking at it.

Infringers geo-fence, and your office does not qualify

A seller shipping counterfeits into Germany has no interest in appearing to a US researcher, and marketplaces make it easy to restrict visibility by shipping destination. The same listing that is invisible from your desk is the top result from a Berlin consumer address.

So the first requirement is unremarkable: query from the markets you are protecting. Rotating residential covers 195 countries with city and ASN targeting, which is the coverage this work needs.

for cc in de fr it es pl; do
  curl -x "http://user-country-$cc:[email protected]:8080" \
    -s "https://marketplace.example/search?q=your-brand" \
    -o "listings-$cc.html"
done

The country list should come from where your goods actually sell and where your trademarks are actually registered, not from the countries that are easy to check.

Repeat visitors get a different storefront

The second reason sweeps come back empty is that infringing sellers watch for exactly the behaviour a brand protection team exhibits: the same address, requesting the same brand terms, on a schedule, never buying anything.

Once an address is flagged as a rights-holder or an investigator, it stops seeing the listing. Not blocked — served a clean version. That failure is invisible, because the page returns 200 and simply has nothing on it.

Per-request rotation removes the pattern. Each query arrives from a different consumer address with no history against your brand terms, and there is nothing stateful in a search query that needs continuity.

Where you do need continuity — following a seller through to their storefront, a product page and a checkout estimate — pin the flow with a session token so those steps arrive coherently:

curl -x http://user-country-de-session-case4417:[email protected]:8080 \
  -s https://marketplace.example/seller/94120

Same token, same exit address, up to 30 minutes on the residential pool. One case, one session token, is a clean rule that also makes your evidence trail reproducible.

Evidence has to survive being challenged

A takedown gets contested. What separates a notice that succeeds from one that stalls is whether you can show what was shown, where, and when.

That means capturing more than a screenshot:

• The full HTML response, stored unmodified.
• The exit IP and its country and city, recorded per capture.
• A UTC timestamp with the timezone written down rather than implied.
• The request URL including every parameter.
• The HTTP status and response headers.

import json, datetime, requests

def capture(url: str, country: str, case: str) -> dict:
    proxy = (f"http://user-country-{country}-session-{case}"
             f":[email protected]:8080")
    proxies = {"http": proxy, "https": proxy}

    ip = requests.get("https://api.fleetproxy.com/v1/ip",
                      proxies=proxies, timeout=30).json()
    r = requests.get(url, proxies=proxies, timeout=30)

    return {
        "url": url,
        "status": r.status_code,
        "captured_at": datetime.datetime.now(datetime.UTC).isoformat(),
        "exit_ip": ip["ip"],
        "exit_country": ip["country"],
        "exit_city": ip.get("city"),
        "body": r.text,
    }

Recording the exit address alongside the capture is what lets you answer "shown to whom" months later. Without it you have a page and an assertion.

Long-running monitoring needs a stable identity

Sweeps are one job. Watching a known infringer over weeks is another, and it has the opposite requirement.

If you are logged into a marketplace seller account, a buyer account used for test purchases, or a monitoring dashboard, the address needs to stay put. An account that logs in from a different country every day gets flagged and frequently locked. Static residential is the right product: ISP-registered, leased to one customer, unmetered at $3.50 per IP per week, with two free replacements a week if an address gets blocked.

The division is clean. Discovery rotates. Anything with a login is static, one address per account, indefinitely.

Mobile-only listings exist

A growing share of marketplace and social commerce inventory is served only to mobile clients, and some of it is served only to mobile network clients — a desktop browser with a spoofed user agent gets the desktop catalogue.

Where your investigation keeps coming up empty against a platform you know has infringing inventory, check it from a carrier address. Rotating mobile covers 60+ carriers across 38 countries at $3.40 per GB, which is enough to establish whether the listing is mobile-gated before you commit to a larger mobile budget.

What to measure

Brand protection pipelines fail quietly, so instrument for silence:

• Listings found per market per run. A market that suddenly returns zero has almost certainly started filtering you, not stopped infringing.
• Response size distribution. A clean storefront served to a flagged address is consistently smaller than a real one.
• Success rate per exit country, never aggregated. One filtered market hides easily inside a healthy overall number.

For the wider workflow, including takedown handling, see brand protection.

A working checklist

1. Query from every market you sell in and hold trademarks in.
2. Rotate per request for discovery; there is no state to preserve.
3. Use one session token per case for multi-step evidence gathering.
4. Record the exit IP, city and UTC timestamp with every capture.
5. Put anything with a login on a static residential address, one per account.
6. Test suspected mobile-gated platforms from a carrier exit before ruling them clean.
7. Alert when a market's result count drops to zero rather than treating it as good news.