CISCyber Investigation Services
Get Criminal Alerts

ResearchCounterfeit series, Part 3

How Brands Can Squeeze Counterfeiters From the Storefront Side

Turning the Counterfeiter's Own Marketplace Behavior Against It

Cyber Investigation ServicesJuly 2026

The Takedown That Does Not Stick

A brand fighting counterfeits has real tools, and almost all of them aim at one thing at a time. Customs inspects a shipment. A cease-and-desist letter targets a seller. A takedown notice pulls one product page. An account complaint suspends one storefront. Each move lands on a single node. The counterfeiter runs many nodes, and that gap is the whole trick.

Onur Aksoy proved it in federal court. He operated out of Miami and held dual United States and Turkey citizenship. In the record he used the aliases “Ron Aksoy” and “Dave Durden.” Over roughly a decade he built at least 19 companies across New Jersey and Florida. Prosecutors grouped them, with about 15 Amazon storefronts and at least 10 eBay storefronts, under one name, the Pro Network Entities. The product was counterfeit Cisco networking gear, imported from China and Hong Kong and resold as genuine. The operation generated over $100 million in revenue.

Amazon was not asleep while this ran. The criminal complaint records it plainly. “Amazon routinely terminated specific product listings for purported Cisco products on Amazon storefronts under the control of Aksoy and Pro Network, and even entire storefronts, in response to counterfeit complaints.” The takedowns happened. The business kept running anyway. Fifteen storefronts, opened one after another from January 2014 to September 2020, absorbed years of listing-level and storefront-level enforcement and kept selling.

What finally stopped Aksoy came from the physical world, not the platform. Agents searched the Doral, Florida headquarters in July 2021 and seized about 1,156 counterfeit devices. He was arrested in June 2022 and pleaded guilty in June 2023. In May 2024 he drew a 78-month sentence and a $100 million restitution order. By then his fakes had reached hospitals, schools, government agencies, and, according to the Justice Department, platforms supporting the F-15 fighter and the B-52 bomber. A single storefront takedown never had a chance against a business built to lose storefronts.

That is the lesson a brand has to start from. Aksoy was caught, but the redundancy that carried him for years is not unique to him. It is the counterfeiter’s standard defense, and our marketplace data shows it running at population scale right now.

Why the Storefront Side Is the Better Target

The factory sits in another country and rarely answers a U.S. process. The border stops a fraction of what ships. The storefront is the one part of the operation that has to stand in public. It takes orders and collects the money where the buyer can see it. That makes it the exposed surface, and the place a brand can reach without a passport or a warehouse raid.

It is also the point where the operation leaves a record. A seller cannot counterfeit quietly and sell loudly at the same time. To move volume it has to list, and every listing it opens or loses is visible in public marketplace behavior. Re-listing under a fresh name is visible too. The manufacturing side hides. The selling side performs in the open, because selling in the open is the point.

So the useful question is not how to pull one more listing. It is how to see the organization behind the listings, and how to aim at that instead of at its interchangeable parts.

The Shape of the Counterfeit Side

The counterfeit side is not one kind of seller. It runs from a lone operator to a coordinated organization, and the organization is the one that defeats ordinary enforcement. Our published series on organized retail crime’s online fences found the same crowd-of-small-accounts structure on the stolen-goods side. It shows up on the counterfeit side too, and larger.

Searching the monitored universe for groups of storefronts that share many of the same rare products, we find 32 such clusters. Eighteen of them lean counterfeit rather than stolen-goods. The largest counterfeit-leaning cluster is 169 separate storefronts hubbed in Florida, acting as one organization across a shared catalog. The clusters below it are far smaller. There are 17 storefronts registered in Delaware, then 8 in Florida, 7 in New York, and 6 in Texas.

Here is the finding that should change how a brand-protection team reads a marketplace. A large counterfeit organization does not appear as a large seller. It appears as a crowd of small, forgettable accounts.

The largest fake-leaning cluster is 169 separate Florida-hubbed storefronts acting as one organization, pooling an estimated $35.8 million a month at the upper bound of the pooled peaks. The next-largest fake clusters are an order of magnitude smaller, 17 in Delaware, 8 in Florida, 7 in New York, and 6 in Texas.

The numbers cut against intuition. A grouped seller in our data is individually smaller than a solo one. Median peak monthly revenue for the grouped cohort is $22,200, against $57,822 for solos. The scale does not live in any single storefront. It lives in the pool. The 169-member Florida organization pools an estimated $35.8 million a month. Read that dollar figure as an upper bound on the pooled peaks rather than a hard total. It sums per-seller estimates over a lead-quality cohort. The member count and the Florida hub are the firm facts. The dollars are directional.

The typical solo counterfeit seller is larger by median, $57,822 against $22,200 for the typical grouped one. Yet the grouped storefronts pool into organizations, the largest running 169 storefronts at an estimated upper bound of $35.8 million a month.

This is distribution protection, whether or not anyone drew it up that way. Spread the operation across 169 modest accounts and no single suspension slows it down. Amazon freezes one storefront and 168 keep selling. The takedown math only works when a brand can see the group as one organization instead of 169 separate small fry. Of the counterfeit cohort, 213 sellers, about 39 percent, sit inside one of these groups.

How the Machine Dodges the Tools You Already Use

The multi-storefront trick is the main defense. Two smaller moves sit underneath it, and both blunt the tools a brand reaches for first.

The first is mark avoidance. In our brand casework we see two kinds of seller. One references the brand’s trademark in its listings, which makes it reachable by a trademark takedown. The other lists against a bare model or part number and never prints the mark at all. That second seller is selling the same fake while dodging trademark-based enforcement entirely. We describe this from casework rather than counting it, because the supporting sample is a small pilot. The point is directional and it matters. Naming the brand is the easy target. Selling the fake without ever naming it is the harder one, and a takedown queue keyed to the mark never sees it.

The second is churn. The classification depends on stranded listings, so a high stranding count in the cohort is partly built in. It should not be read as a discovery on its own. The texture is still telling. The median cohort seller carries 4 frozen listings and the 75th percentile carries 9. A single seller carries 695, and the cohort holds 10,609 stranded listings in all. A frozen listing is a loss the seller absorbs and works around. The account keeps operating and opens fresh listings to replace what it lost. Enforcement that removes listings one at a time is fighting a process the seller has already priced in.

The Stakes That Justify Acting

None of this would matter much if the goods were harmless. They are not.

The counterfeit catalog leans hard toward products that have to work or someone gets hurt. Brake kits and brake pads lead by a wide margin, and safety-critical auto parts take six of the top eleven categories in all. Motorcycle and sports helmets rank ninth. A counterfeit brake pad is not a knockoff handbag. It is a failure point on a two-ton machine at highway speed.

The external record shows what that failure looks like. The National Highway Traffic Safety Administration has warned that substandard replacement air-bag inflators, “likely illegally imported into the United States,” can turn deadly. In the agency’s account, “Ten people have died and three others were severely injured in 13 crashes,” and “these fatalities occurred in crashes that should have been survivable.” Instead of cushioning the driver, the counterfeit inflator explodes, “sending large metal fragments into drivers’ chests, necks, eyes and faces.”

Electronics carry a quieter version of the same risk. Underwriters Laboratories bought 400 counterfeit Apple chargers across eight countries in 2016 and tested them. More than 99 percent failed a basic safety test. The Food and Drug Administration has warned since 2006 about counterfeit home-use test strips for glucose or warfarin. They can produce inaccurate readings that lead to over- or under-medication, “including death.” In 2026 the Consumer Product Safety Commission warned that bad actors are increasingly using counterfeit certification marks to move hazardous products through e-commerce platforms. The consumer buying a $30 part off a marketplace listing has no way to see any of this coming. That is the reason to work the problem, and it is why aiming at the organization rather than the listing is worth the effort.

The Playbook

For a brand sitting on a counterfeit problem and watching takedowns fail to stick, the storefront side offers concrete moves. None of them require inside access to a marketplace.

Treat a storefront network as one organization, not N small sellers. This is the first move and the one everything else depends on. A cluster of 169 accounts sharing a catalog is a single target that happens to wear 169 faces. File against it and refer it as one entity, not as 169 separate defendants. Chase the faces one at a time and the redundancy wins, the way it won against listing-by-listing takedowns for years.

Fund a test buy, and read the lot code. A behavioral lead is not proof until something physical comes back. The Government Accountability Office showed the method at its simplest, buying 47 items from third-party sellers and having the brands examine them. Twenty came back counterfeit. For this cohort the lot code is the tell. About 72.6 percent of the categorized catalog sits in categories that are supposed to carry a manufacturer lot or batch code. A genuine unit traces back to a real production batch. A fake cannot, because there is no genuine batch behind it. A small run of buys returns units whose codes trace to nothing, or whose codes have been left off or defaced. Either result is something a lawyer can move on.

Use Schedule A litigation, and know its edges. In a Schedule A case, one brand sues dozens or hundreds of anonymous online sellers at once, all listed in a sealed exhibit. The court can freeze their marketplace and payment accounts before they are ever notified. The volume is large. IP-firm coverage, citing a Westlaw docket search, counts roughly 4,207 such cases filed in the Northern District of Illinois between January 2013 and February 2025. That one district hosts more than 80 percent of them nationwide. The tool has real limits. It joins many unrelated sellers in one action and files under seal. The freezes can sweep in legitimate sellers by mistake. Judges have pushed back. Judge John Kness in the Northern District of Illinois has stayed Schedule A cases. He cited their tension with the Federal Rules of Civil Procedure and with fundamental principles of due process. Sellers also re-spawn under new names, the same pattern Aksoy ran by hand. Schedule A is powerful and it is not a finishing move.

Push marketplaces to enforce the INFORM Consumers Act. The law took effect on June 27, 2023. It requires marketplaces to verify and disclose identity information for high-volume third-party sellers. The threshold is 200 or more transactions and at least $5,000 in revenue in a year. Penalties reach $53,088 per violation. Hard enforcement raises the cost of hiding behind a fresh screen name, which is the move the whole re-spawn defense rests on.

Route by structure. A lone seller is one takedown or one Schedule A defendant, and the ordinary tools fit it. A coordinated group of many storefronts is a different animal, and sending it to a single-listing process wastes the case. Map the cluster first, then aim at the organization as a whole. The structure in the data tells you which path a target belongs on before you spend a dollar.

Work the public record before the subpoena. Listing histories and the catalog are open. The behavioral signature is measurable now across hundreds of sellers. It is a seller that keeps listing and keeps losing listings at a rate no clean retailer does. A brand can build the picture that points its buys and its filings before any court process begins.

What Changes When Brands Move Together

One brand running this playbook closes cases against its own fakes, one cluster at a time. Each case is real. Each is also partial, because a counterfeit organization rarely fakes a single brand. The 169-storefront catalog carries products from many brands at once, and each brand sees only the slice aimed at it.

Pool what each brand observes and the arithmetic flips. A cluster that looks like scattered small accounts to any one brand resolves into a single organization when the views are joined. The lot-code test and the structure map both scale across brands without any new access. A counterfeiter weighing whether to spread across 169 storefronts can no longer count on each brand chasing its own faces separately. A takedown aimed at the organization collapses all of them at once. The redundancy that beat listing-by-listing enforcement for a decade only works while each brand fights alone.

The storefront side was visible the whole time Aksoy ran, and it is visible now. Hundreds of counterfeit-classified sellers are listing today, shipping goods, losing listings at a rate no honest retailer matches, and hiding in ordinary marketplace traffic. Amazon’s own enforcement removes listings and storefronts every day, and Aksoy’s fifteen storefronts show why that alone is not enough. The machine survives piecemeal takedowns. It does not survive being mapped and hit as one thing.

A Note on Method

The group figures in this article are analytical constructs, not adjudicated conspiracies. A “group” means sellers whose catalogs overlap so heavily they behave as one distribution network. That is directional evidence of coordination, not proof of a legal enterprise, and we name no seller or group from our own data. The cohort itself is a classification of public marketplace behavior across roughly 84,000 Amazon sellers under CIS monitoring. It is not a finding of guilt, and not built from inside access to Amazon or to any seller’s books. A seller enters the cohort when it repeatedly loses listings of counterfeit-prone product types in ways honest retailers do not, while it keeps selling. We do not publish the thresholds or the recipe, because a public detection method is a public evasion manual.

Every count here is a floor as of the July 16, 2026 snapshot, and the classification re-scores continually, so the numbers drift. Revenue figures are snapshot estimates, reported as medians only, computed over the sellers that carry an estimate. The one pooled dollar figure is the roughly $35.8 million a month for the largest cluster. It sums per-seller peak estimates over a lead-quality cohort, and is presented as an upper bound rather than a total. The medians read low for a structural reason. Public trackers credit a listing’s sales to whoever holds Amazon’s Featured Offer at the moment they sample. Since 2023 Amazon has filled U.S. orders through eight largely self-sufficient regional networks. One vantage point misses the winners in other regions. In our casework, when a seller’s own records surface later, the real volume routinely runs above the public estimate. We say that as experience, not as a measured figure. The Aksoy quotes were captured through public mirrors and Internet Archive copies, because the Justice Department’s own site blocks automated retrieval. Each was checked against the DOJ victim page for the case. The storefront dates in that account are DOJ’s “earliest known activity” values, which are floors, not full lifespans. No per-storefront end date was invented, because the public record does not carry one.

Sources

About Cyber Investigation Services

Cyber Investigation Services is a licensed private investigation firm with 16 years of work in ecommerce crime. The firm builds intelligence on counterfeit, stolen, and diverted goods moving through online marketplaces, and works with brands and law enforcement to act on it.