Whiteboard Tutorial: Bad Actor Networks

Bad Actor Networks pose a high risk to brands online, diverting e-commerce revenues and eroding consumer trust by infiltrating channels across the globe.

In this Whiteboard Tutorial, we:

  • Define ‘Bad Actor Networks’ and provide real-world examples;
  • Discuss why they pose a great threat to your business, and;
  • Finally, set out the key technology solution that can take down these infringers at scale

Audio recording

An edited version of the Whiteboard transcript can be found below.

Bad Actor Networks – what are they?

“Whack-a-mole” is a term that is often used to describe a frustrating Brand Protection practice where for every infringement that is removed another appears. This is due to Bad Actors being persistent and the challenges that can be faced in enforcing against certain online locations – brand misuse is a profitable business and removing individual listings will not stop the overall operation.

Bad Actors Networks are structured like agile businesses operating via multiple channels to reach more consumers. There is a range of network structures – many are smaller operations, but businesses also face threats from larger sophisticated operations.

Smaller networks often comprise of multiple websites, marketplaces, and social media selling channels, while larger sophisticated operators may have hundreds of channels often also linked to brick and mortar locations or a manufacturer.

Case study 1: Counterfeiting Network in Turkey

An example of a common Bad Actor Network: Counterfeiting Network in Turkey – 10 stores operated across 4 Turkish Marketplaces and 2 Global Social Media Platforms. Whole operation linked to 2 Registered Companies in Turkey.

  • Sellers set up stores on all major e-commerce platforms in the region to maximise their reach. Often operating multiple stores on one platform. Removing some listings from one store will not greatly impact the seller operation where they have multiple stores.  
  • Sellers also use social media to advertise their products and engage with customers. They advertise their products, marketplace stores and contact details. Social media accounts take time to build up and attract followers. 
  • When only some of their operation and not the whole network is known about, enforcement is not properly targeted. 
  • In this case the seller network operates registered businesses in Turkey – this information can also help to bring down the network. 

Case study 2: Large phishing network targeting multiple brands

An example of a more complex network: 100+ phishing websites detected with 160 brands impersonated by one network.

  • Websites are set up to mirror brands official stores offering branded products for sale. By offering discounted brand products, bad actors are collecting personal and payment information from unsuspecting customers. These Websites are also used to spread Malware. Impersonating Social Media accounts and Ads, Search Engine natural searches, Paid Search, and Referrals from other sites are commonly used to divert customers to these fraudulent sites. 
  • The Websites are hosted with multiple hosting providers and registrars and removing individual websites often will not make an impact on the operation of the infringers. New sites are easy to set up and pop up overnight resulting in little impact for a lot of effort.
  • Tackling social media accounts for these bad actors makes much more impact. 

How you can tackle Bad Actor Networks and the benefits of taking a strategic approach

  • To stop playing a whack-a-mole with bad actors, you need to operate strategically – tackle the weak points in the network, not individual infringements or hard to stop websites.
  • Use the latest techniques to drive targeted action – Network Analysis connects the dots between the sellers, drives   visibility over the entire network and targets enforcement at the weak points.
  • Eliminate the weak points sends the right message to the businesses and operators behind it.
  • Collaborate – Group action by Service Providers and Platforms and notify them of the activity observed with the view to banning the network from their platforms to prevent re-offending activity. Consider joining action with other brands infringed by the network for more effective enforcement and to save on legal costs.

By effectively removing Bad Actor Networks, you will see a significant reduction in infringement online, reduction in consumer diversion, and growth of revenue.


In this Whiteboard Tutorial, we’ve defined ‘Bad Actor Networks’ – agile businesses operating via multiple channels to reach more consumers; provided two real-world examples; and detailed why they often pose a greater threat to your business than individual infringers. Finally, we’ve set out the technology you can use to hit the weak points and take out the problem.

If you believe your brand is being exploited by Bad Actor Networks, consider the right technical and strategic solution for your Brand Protection program.

You can set up a session with one of our experts to discuss the outcomes you want to achieve for your brand.

Whiteboard Tutorial: Network Analysis

Not all infringers pose the same risk. The biggest threats to your brands are often network-level operators that are structured like agile multinational businesses.

Network Analysis is a core module of Incopro’s Brand Protection platform Talisman that powers a strategic approach to tackling Bad Actor Networks. View our Whiteboard Tutorial to learn why it is critical to discover, prioritize, and act against network operators and how Network Analysis technology is used to connect entities together – online and offline.

Access the tutorial
Whiteboard Tutorial: Network Analysis