Loading page content.
Loading page content.
Trust and safety
Infringers do not show their listings to the brand. Monitoring from ordinary consumer addresses in each market is how a trust and safety team sees the same storefront a customer is about to buy from.
The problem
Counterfeit operations and unauthorised resellers actively defend against the people who would take them down. The common technique is cloaking: the listing renders normally for ordinary consumer traffic and renders as something innocuous — a different product, an out-of-stock notice, or a blank page — for visitors that look like a rights holder. The signals used are crude and effective, and the most common one is the visitor's IP range.
Corporate networks and the well-known ranges of enforcement vendors get blocklisted quickly and shared between operators. Once an address is on that list, every check from it reports the site as clean, so a monitoring programme can run for months and report a falling infringement rate while the actual storefront is untouched.
Geography is the second axis. Grey-market and parallel-import listings are frequently shown only in the markets they target, so a global sweep from one country systematically under-counts exactly the territories where enforcement matters most.
Why proxies
An enforcement notice rests on a claim about what was offered, to whom, and where. That claim is only as good as the conditions of the observation. Collecting from a consumer ISP address inside the target market makes the capture representative of what a buyer in that market was shown, and recording the exit country and time makes it reproducible by a marketplace's own investigator.
Rotation matters for coverage rather than throughput. Each check leaving from a different consumer address prevents an operator from learning and blocklisting the monitoring programme, which is the failure mode that quietly ends most in-house efforts.
Recommended product
A fresh residential IP on every request, or one held for 30 minutes
from $1.60/IP/day
App-store listings and in-app marketplaces frequently gate on carrier networks, and a mobile port is the only way to observe those as a handset does.
from $3.50/IP/wk
Where an investigator needs a durable account on a marketplace to view seller history, a fixed ISP address per account is the shape that keeps the account stable.
Worked example
Cloaking is detectable by comparison. Fetch the same listing from a consumer exit and from an ordinary hosting address, hash both, and a divergence is the finding. This is a two-line change to a monitoring job and it turns a clean report into an accurate one.
import hashlib
import requests
USER = "fp_8s2k4d19"
PASSWORD = "Xk7mQ2pTz9vRn4Ls"
RESIDENTIAL = f"http://{USER}-country-de:{PASSWORD}@gate.fleetproxy.com:8080"
DATACENTER = f"http://{USER}-country-de-pool-dc:{PASSWORD}@gate.fleetproxy.com:8080"
def body_fingerprint(url: str, proxy: str) -> tuple[int, str]:
response = requests.get(
url,
proxies={"http": proxy, "https": proxy},
timeout=(10, 30),
)
normalised = normalise(response.text) # strip nonces, timestamps, CSRF tokens
return response.status_code, hashlib.sha256(normalised.encode()).hexdigest()
def check(url: str) -> dict:
consumer_status, consumer_hash = body_fingerprint(url, RESIDENTIAL)
hosting_status, hosting_hash = body_fingerprint(url, DATACENTER)
return {
"url": url,
"consumer_status": consumer_status,
"hosting_status": hosting_status,
# Two different pages for two different networks is the definition of
# cloaking, and it is the row an enforcement team wants surfaced first.
"cloaked": consumer_hash != hosting_hash,
}
print(check("https://marketplace.example/listing/998877"))Replace the credential with the one in your dashboard. The gateway host, port and username format are the same across every product.
Pitfalls
Each of these is common, cheap to fix, and expensive to leave in place. They are listed in roughly the order teams hit them.
The office range is the first thing a serious infringer blocklists, and once it is on the list every check reports a clean listing. If a monitoring programme's infringement counts fell without an enforcement campaign behind the fall, the vantage point is the first thing to check.
Operators rotate storefront names constantly while keeping the same images, phone numbers, payment handles and shipping origins. Cluster on those durable attributes instead, or the same operation is counted as fifty unrelated cases.
An image alone cannot establish when, from where, or under what conditions a listing was seen. Store the URL, the exit country, the timestamp, the status code and the raw HTML with every capture — marketplaces routinely ask for exactly that.
A monitoring list built from last quarter's takedowns measures last quarter. Feed the list from search, marketplace queries and newly registered domain feeds in each market so new storefronts enter the programme before they mature.
Questions
Start on 50MB of free residential bandwidth, measure your own targets, and scale into volume tiers that step the rate down as the job grows. Unused bandwidth never expires.
No card required for the trial. Cancel or downgrade at any time.