Forty-six storefronts, six operators: tracing counterfeit safety equipment to its source

The situation

The client designs and manufactures climbing and work-at-height equipment. Its brand protection team had been reporting counterfeit listings for two years. Each takedown was followed by new listings within days, often with the same photographs. Then a customer returned a carabiner that had failed in a gym. The client's laboratory tested 30 counterfeit units bought from marketplaces. Eleven failed at less than half the rated load.

The problem had stopped being commercial. Someone could be killed.

The question

How many sellers are there really, who operates them, and where are the products made and shipped from? The client needed evidence it could use with marketplaces, customs authorities and, if necessary, the courts.

What we did

A lead investigator, an analyst specializing in online marketplaces, a trade data analyst and two linguists worked the case, with an independent red-team reviewer. Test purchases had already been made by the client's own team. We did not contact any seller.

1. Captured the market

We captured 212 active listings across nine marketplaces, including product pages, seller profiles, policies and reviews, and hashed every capture. Listings were grouped by product, price and wording.

2. Followed the photographs

Reverse image searches across several engines showed that the listings used photographs from just three original shoots. All three shared a studio background, the same props and, in one set, the cropped remains of a watermark. The earliest copies of all three sets appeared on a business-to-business wholesale platform, in listings by a trading company in a manufacturing region, eight months before the first counterfeit appeared on a consumer marketplace.

3. Resolved the storefronts

The 46 storefronts that sold the dangerous product lines shared customer service messaging identifiers, return addresses and seller policy text. Grouped by those shared details, they resolved to six operators, each running between four and eleven storefronts under different names.

4. Read the corporate and trade records

The trading company's registry record, read in the original language, showed a shareholder who also owned two metalworking workshops in the same district. Published job advertisements from both workshops sought staff for forging, anodizing and "logo laser marking". Shipment records showed consignments from the trading company, declared as hardware accessories, to fulfillment warehouses in three countries that matched the return addresses of five of the six operators.

5. Checked the certification claims

The counterfeit packaging carried a product certification number. The certification body's public register showed that the number belonged to a different product from a different manufacturer and had expired three years earlier.

6. Challenged the conclusions

The reviewer argued that the trading company could be a reseller of counterfeits made elsewhere. The earliest photographs, the shareholder's ownership of the workshops and the workshops' own advertisements made manufacture by those workshops the most likely explanation, but none of it proved what happened on the factory floor. That finding was reported at moderate confidence.

What we found

• High confidence: the 46 storefronts are operated by six operators, identified by shared contact identifiers and return addresses.
• High confidence: the product photographs used across all storefronts originated with the trading company.
• Moderate confidence: the counterfeits are likely manufactured in the two workshops owned by the trading company's shareholder.
• High confidence: the certification number on the packaging is invalid for the product.

The outcome

• Marketplaces removed 41 of the 46 storefronts within three weeks and banned the six operators' accounts. Repeat listings fell by 87 percent over the following quarter.
• Customs authorities in two countries recorded the client's marks, targeted consignments matching the shipment pattern and seized 18,400 counterfeit units.
• The client issued a public safety notice describing how to identify the counterfeits.
• Civil proceedings were opened against two of the operators in jurisdictions where they held assets.

What made the difference

Treating the storefronts as the visible end of a supply chain. The photographs gave us the source, the shared seller details gave us the operators, and local-language corporate and trade records connected the two. Every link was captured and graded, so the marketplaces, customs and the courts could each act on the part of the evidence that concerned them.