The Anatomy of a Counterfeit Storefront Network

Fifteen Storefronts, One Operation

On Amazon, the first storefront was called Albus Trade Hub. It opened in January 2014 and sold Cisco networking gear, the switches and routers that run the networks inside offices, hospitals, and government agencies. When a counterfeit complaint came in, Amazon took listings down. Sometimes it took the whole storefront down. By then another store was already selling the same product under another name.

Over about six years, fifteen Amazon storefronts and at least ten eBay storefronts sold the same counterfeit Cisco equipment, one name replacing the last. Federal prosecutors later grouped all of them under a single label, the Pro Network Entities. One man ran the whole thing.

His name was Onur Aksoy, of Miami, a dual citizen of the United States and Turkey. In the record he used the aliases “Ron Aksoy” and “Dave Durden.” Over roughly a decade he formed at least 19 companies in New Jersey and Florida to hold the storefronts and move the money. The operation generated more than $100 million in revenue. In May 2024 a federal court sentenced Aksoy to 78 months in prison and ordered $100 million in restitution to Cisco.

This is what a counterfeit operation looks like when it is built to survive being shut down. To see how it worked, start with what it sold and why the marketplace made it possible.

What Marketplace Counterfeiting Is, and Why the Internet Changed the Math

A counterfeit is not a stolen good. Our recent series on organized retail crime followed online fences, sellers who move real merchandise swept off store shelves and relisted as ordinary product. This is the other half of the marketplace. A counterfeit was never real to begin with. It is manufactured to imitate a brand, then shipped across a border and sold beside the genuine article at a price close enough to pass.

Counterfeiting is an old crime. The distribution channel is new, and it changed the arithmetic that used to hold the crime in check. The economics reward the copy. A fake costs a fraction of the real product to make. The marketplace then hands it the same buyers the genuine article would reach.

For most of its history, a counterfeiter faced the same ceiling a street vendor faced. Fakes moved through flea markets and back rooms, in front of local buyers, at prices that advertised the risk. A marketplace listing removes every part of that ceiling. A listing reaches a national buyer pool. It wears the platform’s trust wrapped around it. And it puts a screen between the seller and the person paying.

The hard part for a buyer is that nothing on the screen gives the fake away. A counterfeit listing carries the brand’s name, the brand’s photos, and a believable price. The genuine article and the copy can sit on the same catalog page, described in the same words. A shopper comparing offers sees two sellers, not a real product and a fake one. The deception is finished before the box ever ships.

The border catch alone shows the volume. In fiscal year 2024, U.S. Customs and Border Protection seized 32.4 million counterfeit and pirated items, and those are only the shipments that were stopped. Aksoy’s operation ran the marketplace model at industrial scale, and it did one thing most counterfeiters do not. It built redundancy.

The Anatomy of the Operation

Acquisition

The supply came from overseas. Aksoy imported tens of thousands of counterfeit Cisco switches and other devices from suppliers in China and Hong Kong. He resold them in the United States as genuine. At least $55 million flowed back to those suppliers over the life of the scheme.

The border did not miss the traffic entirely. Between 2014 and 2022, U.S. Customs seized roughly 180 inbound shipments bound for the Pro Network Entities, about 860 devices in all. Those seizures ran the length of the operation and did not stop it. For a business importing tens of thousands of units, 180 caught shipments were a cost of doing business, not a wall.

Distribution

Fifteen Amazon storefronts carried the goods to buyers, backed by at least ten more on eBay. Each looked like a routine electronics reseller. The Amazon names, drawn from the Justice Department’s own list, read like generic trade shops. Albus Trade Hub opened first, in January 2014. EasyNetworkUS followed two months later. Others arrived in sequence over the years after, names such as Netkco LLC, TradeOrigin US, TeamTech Global, Smart Network, and Renewed Equip. The last of the fifteen, Target-Solutions, opened in September 2020.

The dates on those storefronts are the Justice Department’s earliest-known-activity values. They mark when each store first surfaced, not its full lifespan. Read as a group, they show a pattern. New storefronts kept opening across the entire six-year span, and they kept opening while older ones were being shut down.

Behind the storefronts sat a matching set of companies. Aksoy formed at least 19 of them across New Jersey and Florida. These were the legal shells that held the bank accounts and received the payments. A storefront is easy to replace when a company stands ready to open the next one. The paperwork was part of the redundancy.

Survival

That was the design. The criminal complaint records the enforcement plainly. “Amazon routinely terminated specific product listings for purported Cisco products on Amazon storefronts under the control of Aksoy and Pro Network, and even entire storefronts, in response to counterfeit complaints.”

Read that sentence closely. Amazon was removing listings. It was removing whole storefronts too. At many points in the run, several of these stores were live at once. A shutdown removed a fraction of the selling capacity, never all of it. The operation absorbed both and kept running, because no single storefront was the business. The business was the network. A takedown that would end a one-store seller cost Aksoy one node out of fifteen, and a replacement was usually already live. Enforcement that lands one storefront at a time cannot catch an operation that runs many at once.

Money

The money matched the scale. The Pro Network Entities generated more than $100 million in revenue, and the retail value of the genuine equivalents ran into the hundreds of millions.

Where that gear ended up is the part that should stop a reader. According to the Justice Department, Aksoy’s counterfeit devices reached “platforms supporting the F-15, F-18, and F-22 fighter jets, AH-64 Apache attack helicopter, P-8 maritime patrol aircraft, and B-52 Stratofortress bomber aircraft.” Customers included hospitals, schools, and government agencies. A counterfeit network switch does not look dangerous. Buried inside a hospital’s systems or a military platform, it is a reliability failure waiting in critical infrastructure, sold as the real thing.

The Takedown

The network survived years of marketplace enforcement. It did not survive a warehouse search. On July 21, 2021, federal agents searched Aksoy’s headquarters in Doral, Florida. They seized about 1,156 counterfeit Cisco devices with a manufacturer’s list value near $7 million.

The case moved through the courts from there. Agents arrested Aksoy in June 2022. The Justice Department unsealed the charges and published the list of storefronts on July 8, 2022. On June 5, 2023, Aksoy pleaded guilty to conspiracy to traffic in counterfeit goods and to commit mail and wire fraud. On May 1, 2024, the court sentenced him to 78 months in prison, six and a half years. He agreed to pay $100 million in restitution to Cisco, with other victims’ amounts to be set later.

The number attached to the fraud tells the same story as the storefronts. A single seller does not move $100 million in fake networking gear. A network of them, opened and replaced for six years, does.

It took a physical raid to end a business that ran on digital storefronts. The listings could be replaced. The warehouse could not.

What This Case Tells Us

Aksoy is worth studying because his defense was structural, not technical. He did not defeat Amazon’s enforcement with clever tradecraft. He outlasted it with redundancy. Fifteen storefronts meant fifteen chances to keep selling, and losing any one of them changed nothing about the other fourteen. That is the core lesson of the case. A marketplace that removes listings and storefronts one at a time is fighting a network with a tool built for single targets.

The harm reach is the second lesson. This was not a knockoff handbag or a fake watch. It was infrastructure hardware sold into hospitals, schools, government agencies, and military platforms. In those settings a hidden failure is not an inconvenience but a risk to safety and readiness. Counterfeiting is often filed under brand protection, a matter of a company’s revenue. Aksoy is a reminder that the same fake can be a safety problem wearing a brand’s name.

We see the same shape in our own work. Across the marketplace sellers we monitor, the counterfeit operators that run the largest volumes tend to work as clusters of storefronts rather than single accounts. No one takedown reaches the whole business. Aksoy ran that structure by hand, and a federal court proved it end to end.

The pattern he built to survive enforcement is the pattern enforcement now has to solve for. Removing a listing is fast. Removing a storefront is slower. Neither reaches the operation behind them, because the operation is not a listing or a storefront. It is the whole set, held together by companies and bank accounts a takedown never touches. To end a network, someone has to see it as a network first. In Aksoy’s case that took years, a border-seizure record, and a warehouse raid. The behavior was legible long before the raid, and the same behavior is legible now, across the sellers still running the play.

A Note on Method

This reconstruction rests on public records. The charges, the seizures, the guilty plea, and the sentence come from the federal court file in United States v. Aksoy and from official Justice Department releases. The direct quotations were captured through public mirrors and Internet Archive copies, because the Justice Department’s own website blocks automated retrieval. Each was checked against the department’s victim-information page for the case.

The storefront timeline is built entirely from those public-record dates. We tried to reconstruct the stores’ marketplace history from historical seller data and found nothing usable. The trackers that follow Amazon sellers only see accounts they meet on the products they watch. Niche business-to-business Cisco gear sat outside that coverage while the stores were live. The absence is itself a finding. A counterfeit operation selling infrastructure hardware to businesses leaves a thinner public marketplace trail than one selling consumer goods. That is one more way this kind of seller stays unwatched.

Two limits follow from working off the record alone. The Justice Department’s storefront dates are earliest-known-activity values, which are floors rather than full lifespans. And the public record does not carry an end date for any individual storefront, so none was invented. The record shows only that Amazon terminated listings and whole storefronts piecemeal until the 2022 arrest ended the operation.

Sources

• U.S. v. Aksoy, No. 3:22-cr-00464, D.N.J. U.S. Department of Justice, USAO-NJ and Office of Public Affairs releases and victim-information page, United States v. Aksoy: https://www.justice.gov/usao-nj
• U.S. Customs and Border Protection, IPR Seizure Statistics FY2024: https://www.cbp.gov/trade/priority-issues/ipr/statistics
• Internet Archive captures of U.S. Department of Justice case pages.

About Cyber Investigation Services

Cyber Investigation Services is a licensed private investigation firm with 16 years of work in ecommerce crime. The firm builds intelligence on counterfeit, stolen, and diverted goods moving through online marketplaces, and works with brands and law enforcement to act on it.