Why Can't Cease-and-Desist Letters Stop the Counterfeiters?

Removing a counterfeit listing addresses one offer for sale. Identifying the people and businesses behind it gives a brand protection team a basis for investigating the wider operation. The question is whether each enforcement action adds to that investigative context, or brings the team back to square one with the next seller account.

One operation behind many storefronts

The prosecution of Onur Aksoy shows why the organization behind the sales matters. According to the U.S. Department of Justice, Aksoy ran at least 19 companies and multiple Amazon and eBay storefronts selling fraudulent and counterfeit Cisco networking equipment. The businesses, collectively called the Pro Network Entities, imported modified devices from China and Hong Kong and sold them as genuine Cisco products.¹

The operation continued despite repeated enforcement. Between 2014 and 2022, Customs and Border Protection seized approximately 180 shipments addressed to the Pro Network Entities. Cisco also sent cease-and-desist letters. DOJ reported that Aksoy used the alias “Dave Durden” in paperwork submitted to CBP and often continued ordering from the same supplier after a seizure. And he personally received millions of dollars from the operation.²

Aksoy pleaded guilty in June 2023 to conspiring to traffic in counterfeit goods and commit mail and wire fraud, and to mail fraud. In May 2024, he was sentenced to six years and six months in prison.¹²

The relevant lesson for brand protection is the structure of the business: multiple companies and storefronts belonged to one operation. A seller account was one part of a much larger investigative subject.

Connect listings to the people and businesses behind them

To investigate that wider structure, teams need to compare what they know about sellers across cases and sources. A marketplace finding becomes more useful when it can be examined alongside company records, test purchases, seizure notices and earlier enforcement activity.

Consider a hypothetical example. A test purchase from one storefront produces a return address that also appears in a seizure notice associated with another seller. That overlap gives the team a specific relationship to examine. Corporate records or further purchase information may help explain whether the sellers share an operator, use the same service provider, or have another connection.

Entity resolution helps organize this work by identifying records that may describe the same person or business.³ A company name, trading name and seller account can then be examined together, with the relevant identifiers and source records available for review. Relationship analysis helps the investigator follow the links between that business and other sellers, suppliers or shipments. Also, a tool that recognizes name variations and groups them as aliases for the same person or business can help investigators connect related records.

The useful question is therefore broader than whether a listing resembles one seen before. What does the available evidence reveal about the operator and its connections? Matching imagery or a shared address can guide that inquiry; the supporting records determine how far it goes.

Keep enforcement history available for the next investigation

Each takedown, purchase and seizure should add to the team’s understanding of the subjects involved. Closing an enforcement task should leave its findings available for comparison when a new account or shipment appears.

A useful record connects the listing to the seller, the supporting evidence and the action taken. Where the team has identified a related company or another storefront, it should retain the basis for that connection. The next investigator can then build on the work rather than reconstruct it from screenshots and separate reports.

Information sharing also affects what teams can establish. In its 2018 review of counterfeit enforcement, GAO reported that private-sector representatives viewed restrictions on CBP information sharing as a constraint on their enforcement efforts.⁴ A practical workflow should make clear what information the team holds and what additional evidence it needs from partners.

This also changes how a team assesses progress. Alongside listing removals, track recurring sellers identified, related accounts linked with supporting evidence, and investigations advanced toward action against an operator or supplier. Those measures help distinguish the volume of enforcement activity from what the team has learned about the business behind it.

How Hubstream can help

Hubstream’s IP and brand protection solution brings enforcement activity, customs seizures, legal cases and third-party intelligence into a shared investigative environment. Teams can examine seller information alongside related companies, shipments and previous actions.⁵

Furthermore, its AI Investigation Assistant supports summarization, enforcement data review and intelligence flagging, helping teams identify material that deserves closer examination.⁵

The workflow can therefore extend beyond resolving an individual listing. Investigators can review a seller’s history, follow its relationships and carry the resulting findings into the next case. The value is in making accumulated information usable when a new lead appears.

Make each enforcement action contribute to the next

A brand protection program needs to address counterfeit offers and develop its understanding of repeat operators. Connecting those activities gives each enforcement action value beyond the listing it removes.

Take a recently closed takedown and ask what would happen if a related seller appeared tomorrow. Could the team retrieve the earlier evidence, recognize relevant connections and decide what to investigate next? That is a practical test of whether marketplace findings are becoming lasting investigative knowledge.