How agile infringer networks restructure and avoid enforcement

We revisit a large-scale infringer network selling counterfeit soccer merchandise to see how it has evolved over time and how it continues to operate despite enforcement attempts by a third party.

In this piece, we explore how the network’s structure has rapidly changed to reach consumers and avoid enforcement. We then look at how the owners have responded to market changes – specifically the creation of ‘branded’ face masks in light of the COVID-19 crisis. Finally, we highlight how an intelligence-led approach will allow you to enforce at a network level to shut down similar operations that target your brand.

What is an infringer network?

First, some context on infringer networks. Criminals often act as part of wider interconnected networks that are akin to large, multinational businesses in the way they operate – they have suppliers, distribution channels, run marketing campaigns and ‘employ’ individuals to promote the products.

How do infringer networks operate?

Bad actors utilize a combination of digital channels including social media, marketplaces, and e-commerce websites to sell their illegal products to large volumes of consumers.

Large-scale counterfeit networks are known to evolve very rapidly to counteract enforcement efforts and are adept in shrugging off ad-hoc takedowns. Utilizing a number of different domains, accounts, and listings, bad actors react quickly to channels that are closed down – they are quickly replaced and the counterfeiting activity continues.

Part 1: Evolution of an infringer network

Over the last 5 years, Corsearch has monitored a large-scale network that distributes counterfeit soccer shirts/jerseys, tracksuits, socks and vests. We’ve documented its behavioral changes to see how it reaches consumers and the methods it has employed to successfully avoided enforcement techniques from third parties.

2016 – The network spreads

In 2016, the network — already in existence for several years — began to expand its operation in the run up to the 2016 European Championships. We identified 80 connecting parts with clear linkage to one company operating by selling fake soccer shirts:

• 47 website domains (at the time, 27 were active)
• 17 Social Media Accounts:
  • 4 x Facebook
  • 3 x Skype
  • 3 x WhatsApp
  • 3 x Twitter
  • 1 x Pinterest
  • 1 x Google+
  • 1 x YouTube
  • 1 x LinkedIn
• 1 Marketplace Store
• 17 email addresses

The network’s structure at the time is mapped below.

2018 – The network responds to enforcement attempts

During the 2018 World Cup, there was little wholesale change to the structure of the network – we identified six Facebook accounts and thirty-three websites, although very few of them were the same as had been operating previously.

Throughout the tournament our analysts noted that if a website was closed, the social media accounts simply switched their promotion efforts to another within the network and the infringement continued unhindered.

2020 – The network consolidates its internal structure and starts hijacking genuine websites to promote counterfeits

In 2020, the network continues to evolve. The key changes in behavior that we have observed over the last year include:

• The owners have stopped using brands within domain name as these were easy to identify and take down using trademark law
• The owners are now using hacked genuine websites to divert traffic to their storefront
• The operation is now consolidated to 4 main mirror websites – down from almost 50 two years ago
• The network now promotes face masks with club insignia printed on the fabric – in response to COVID-19

Use of hijacked websites

We identified that the owners of this network are hacking into WordPress-based websites to redirect traffic to their storefronts.

They create new pages that contain ‘cheap football shirts’ or similar within the URL slug and the page header so that they will appear for these searches. These pages are then subsequently indexed by search engines, at which point the hacker removes the pages from the website. When a user visits these hacked URLs via a search engine, they immediately hit a 404 page which has been set to redirect to the counterfeiter’s storefronts.

The network’s owners have targeted a number of websites from a variety of territories to hijack. As the map below shows, hijacked websites are based in countries across all continents. As a result, the network’s storefronts are able to maximize their global reach.

Brands targeted by network

We looked at the scale of infringement and types of products on offer to get an accurate idea of the number of brands affected by the network. We found the following number of entities were impacted directly or indirectly:

• League/Other football competitions: 15
• Teams: 256
• Kit suppliers: 32
• Sponsors (all sponsors): 226
• Payment providers: 4
• Shipping providers: 3

Although some of these brands are not being counterfeited directly (I.e. a kit sponsor has been removed from a counterfeit jersey or pair of shorts), association with this criminal industry alone has a negative impact on brand reputation – some operations have been shown to directly fund serious crimes such as terrorism and human trafficking.

Facemasks: New products hijacking demand created by COVID-19

Infringers will adapt and exploit any change in the market.

Since the postponement of the 2020 European Championship due to COVID-19, the network’s owners have had to find another event or trend to produce new merchandise for.

Social distancing measures are gradually easing, but the use of face masks by the general public will likely remain. It is widely expected that spectators will be required to wear face masks for their own safety when they are allowed to return to sports matches. In some countries, including the UK, the general public is also mandated to wear face masks on public transport – fans may also want to wear their team’s colors when traveling.

Face masks, therefore, have proved to be the perfect product trend for this network to latch onto.

Counterfeit soccer kit poses risks to brand reputations and revenues. However, illegitimate face masks go one step further and put consumers’ health at serious risk. Undergoing no testing or certification and tied directly to the brand and sponsors, these masks are likely to be completely ineffectual in protecting the wearer and others around them from COVID-19.

Part 2: How to take down large-scale networks

Focus your resources on identifying and enforcing against large-scale networks – the biggest threats to a brand are well organized infringer networks that can infiltrate consumer touchpoints wherever they are based in the world. 

• Equip your business with the technology to monitor their digital activity – Infringer networks’ online operations and activity leaves a data footprint, despite best efforts to cover their tracks.

• Ensure this technology can connect the data from all sources – Not only do you need to detect the data but you also need to connect the right data together to build a true picture of the size and reach of a network. Networks may operate across countless identities, websites, social media accounts, seller profiles, channels & platforms. 

• Train your technology to detect similar activity and relationships to expose the network’s scale and predict future behavior – The key to staying ahead of infringers is being able to predict their next moves and respond appropriately.

Technology needs human guidance, however. Brand Protection experts are needed at two key points: 1) building and optimizing the network models at the front end and 2) determining action that should take both online and offline once you have found a network. 

Corsearch – Providing network analysis and expertise in strategic enforcement 

Taking an intelligence-led approach to fighting large-scale counterfeiting networks is the only truly effective way to shut down these operations. Corsearch uses network analysis technology to achieve this. We scour a vast array of data points such as social media pages, websites, and marketplace listings then match key identifying information such as seller premises, telephone numbers, and email addresses to build a complete picture of an operation and enforce at scale. 

Corsearch’s Brand Protection platform, features in-built prioritization technology that indicates which networks pose the greatest threat to your brand, allowing you to focus your efforts and generate maximum impact. This threat level is informed by factors such as web rankings, visibility to consumers, and whether marketplace sellers are authorized by platforms. 

Corsearch Brand Protection Platform’s ‘Network Analysis’ functionality provides insight into how bad actors use multiple channels and accounts to boost sales. We trace links between all these separate accounts and enforce at a network level to take out the whole operation rather than engaging in ‘whack-a-mole’.  

By addressing the source of the issue, we ensure long-lasting results for brands.

Request your personalized Corsearch Brand Protection platform demo

Learn more about Corsearch’s network analysis technology and how we can help your business take down entire criminal networks with a personalized Corsearch Brand Protection Platform demo.