The brand protection problem
Counterfeiters, unauthorised resellers, trademark squatters and phishing operators all exploit brands online. They list fake products on marketplaces, run lookalike stores, buy ads on brand keywords, and set up sites that imitate login pages. Many of them hide: they geo-block countries where the brand is based, show innocent pages to corporate and datacenter IPs, or only reveal infringing content to visitors arriving from search or ads in specific markets.
That's why brand protection relies on seeing the web as ordinary consumers in each market do. Geonode residential proxies, targeted by country, state, city or ASN, give investigators that view.
What brand protection teams monitor
| Threat | Where it appears | Geonode approach |
|---|---|---|
| Counterfeit products | Marketplaces, social shops, standalone stores | Residential in each market, rotating for discovery |
| Unauthorised sellers | Marketplaces and retailer sites | Residential, regular monitoring |
| Lookalike and copycat stores | Websites found via search and ads | Residential, browser screenshots |
| Brand keyword ad abuse | Search ads | Residential with city targeting |
| Phishing and impersonation | Lookalike domains, fake support pages | Residential and datacenter comparison, isolated browser |
| Grey-market pricing | Retailers in other regions | Residential in each market |
Discovery
Discovery means finding infringements before customers do.
- Search marketplaces for brand terms, product names and common misspellings, from each market where you sell or where counterfeits originate.
- Search engines and ads for brand keywords from different cities, since ads and results differ by location.
- Monitor new domains containing your brand name, and check each one from residential exits.
- Watch social shops and marketplaces popular in each region.
Rotate per request for discovery searches, and keep rates polite.
Defeating cloaking and geo-blocking
Infringers often:
- Show a blank or harmless page to visitors from the brand's home country.
- Block datacenter and corporate IP ranges.
- Show different content depending on whether a visitor arrives from a search or an ad.
Checking each suspicious site from residential exits in several countries, and comparing with a datacenter view, reveals most of these tricks. Follow links from search results and ads where relevant, so the site sees the referrer it expects.
Collecting evidence
Takedowns need evidence. For each infringement, capture:
- Full-page screenshots and the page's HTML
- URL, seller or store identifiers, and listing IDs
- Date, time and exit location (country, city and IP)
- Product details, prices and any trademark use
- Redirect chains for sites reached via ads or links
Use a sticky session for each evidence capture so all pages come from one exit. Store evidence in a structured way, so legal and enforcement teams can use it directly.
Proxy tip: Before scaling, run a short pilot on your real targets with Geonode and record success rate, latency and GB per result. Our our complete Geonode guide explains which Geonode product to start with.
Working with platforms
Most marketplaces, social platforms and registrars have rights-owner programmes or abuse reporting channels. Evidence collected from local residential exits shows what consumers in that market actually see, which strengthens reports. For phishing sites, report to hosting providers, registrars and browser safe-browsing services.
Safety
Some infringing sites, especially phishing pages, can be malicious. Investigate in isolated browsers or virtual machines, never with personal or corporate accounts logged in. See Geonode for cybersecurity research.
Costs
Brand protection mixes light searches with heavier browser evidence captures. Keep discovery HTML-only where possible and use browsers for evidence. Geonode's residential bandwidth doesn't expire, which suits the uneven workload of investigations.
A weekly brand protection routine
- Monday: run automated discovery searches on marketplaces and search engines from each priority market, through residential exits. Flag new listings and domains matching brand terms.
- Tuesday: triage. Separate authorised sellers from suspected infringers, and suspected counterfeits from grey-market goods.
- Wednesday: collect evidence for confirmed cases with sticky sessions, screenshots, HTML, identifiers and exit locations.
- Thursday: file reports through platform rights-owner programmes, registrars and hosts.
- Friday: follow up on earlier reports, update the case log and review metrics.
Useful metrics include new infringements found per week, time from discovery to report, takedown success rate by platform, and repeat offenders. Over time, they show where infringement concentrates and where enforcement is working.
Prioritising markets
Brands rarely have the resources to monitor everywhere equally. Prioritise markets where you sell, where your customers have reported counterfeits, where manufacturing and shipping of fakes is common, and where marketplaces have weaker controls. Geonode's country targeting lets you shift attention between markets without changing tools. For related investigative work on phishing and impersonation, see Geonode for cybersecurity research.
Starting small
If you're new to brand protection, start with one marketplace and one search engine in your two most important markets. Learn the triage and reporting process there, then add platforms and markets.
FAQ
Why do counterfeit sites look normal when I check them?
Many cloak content from the brand's home country or from corporate and datacenter IPs. Check from residential exits in other markets.
Which markets should I monitor?
Where you sell, where counterfeits are commonly produced and shipped from, and where your customers report problems.
Is screenshot evidence enough for takedowns?
Platforms usually want URLs, identifiers and descriptions as well. Capture everything listed above.
Can I automate brand monitoring?
Yes. Automate discovery searches and change detection, and keep a human in the loop for assessing and reporting infringements.
Editorial note: Proxy providers change their pools, features and prices often, so treat any figures here as typical ranges at the time of writing and confirm current terms with the provider before you buy.