Capturing Fake Shop Evidence: Screenshots, HAR Files, Hashes

You have found a fake shop using your brand name. The product images are stolen, the pricing is suspiciously low, and customers are already being misled. The next step is obvious: report it and get it taken down. But this is where most brands stumble.

Platforms, registrars, and legal teams need evidence that is structured, timestamped, and verifiable. Submit the wrong format and your report gets ignored. Submit nothing at all, and the site changes before you can try again.

The evidence you capture in the first 24 hours often determines whether a takedown succeeds or fails.

This guide covers the specific evidence types that platforms and registrars accept, how to collect each one correctly, and why preserving that evidence before the site changes is non-negotiable.

Why Evidence Quality Determines Takedown Success

Platforms such as Amazon, Alibaba, and Shopify all have their own reporting portals, and domain registrars operate under their own abuse policies. What they share is a requirement for clear, timestamped proof that a specific page, at a specific URL, was infringing your rights at a specific point in time.

Weak or incomplete evidence leads to one of three outcomes:

• The report is rejected outright with no explanation
• The platform requests more information, adding days or weeks to the process
• The infringing site changes its content, making your original evidence useless

Timestamped Screenshots

Screenshots are the most commonly submitted evidence type, and the most commonly done wrong.

A screenshot taken with your phone camera, or saved without any metadata, tells the reviewer almost nothing. What they need is a timestamped capture that shows the full URL, the date and time of capture, and the infringing content on the same screen.

What to include in every screenshot

• The full browser URL bar, clearly showing the domain
• The page content that constitutes the infringement (your logo, product images, brand name used without authorisation)
• The date and time, either visible in the system clock or embedded via a tool
• The page title and any pricing or seller information that supports the complaint

Browser-based tools such as the GoFullPage extension capture the entire page rather than just the visible portion, which is important when infringing content sits below the fold. For legal proceedings, tools that generate a certified timestamp, such as those compliant with RFC 3161, provide stronger evidence.

Capture multiple screenshots across different sessions if you can. A single screenshot proves the page existed once. Multiple captures across different dates demonstrate persistent infringement, which strengthens your case considerably.

HAR Files

A HAR (HTTP Archive) file is a JSON-formatted record of all network requests made by a browser when loading a page. It captures every resource the page loads: scripts, images, redirects, and server responses.

Screenshots show what a page looks like. HAR files show how it is built. A convincing fake shop front page can hide a hosting provider, payment processor, or redirect chain that the HAR file will expose.

How to capture a HAR file

• Open Chrome or Firefox and navigate to the fake shop
• Open Developer Tools (F12) and select the Network tab
• Tick "Preserve log", reload the page, and let it fully load
• Right-click within the Network tab and select "Save all as HAR with content"

Submit the HAR file when reporting to hosting providers or escalating to legal counsel, particularly when the site uses a CDN to obscure its true server location. 

Page Hashes

A cryptographic hash is a fixed-length string generated from the content of a webpage. If the content changes even slightly, the hash changes entirely. Generating a SHA-256 hash of a saved page creates a verifiable fingerprint. If the operator later claims the page never contained infringing content, the hash proves otherwise.

How to generate a page hash

• Save the full HTML source (Ctrl+S in most browsers, selecting "Webpage, complete")
• Use CertUtil on Windows or shasum -a 256 on Mac/Linux to hash the saved file
• Record the hash value alongside the capture date and URL

Pair the hash with a timestamped screenshot and you have evidence that is considerably harder to dispute.

WHOIS and DNS Snapshots

WHOIS data shows the registered owner of a domain, the registrar, registration dates, and nameserver information. DNS records reveal where the domain is pointing and what services it is running.

Both can change quickly. Operators of fake shops frequently update WHOIS data after receiving a complaint, or switch hosting to slow down enforcement. Capturing this data at the time you discover the site is essential.

What to capture

• A full WHOIS lookup for the domain, saved as a text file with the date noted
• DNS records including A, MX, and NS entries, captured via a tool such as MXToolbox or the command line (nslookup or dig)
• Any historical WHOIS data available via services such as DomainTools, which can show registration history even after the current records are updated

This information is particularly useful when filing abuse reports with domain registrars, who typically require proof that the domain was actively hosting infringing content at the time of the complaint.

Preserving Evidence Before the Site Changes

Fake shops are built to be disposable. Operators know that once a complaint is filed, they have a narrow window before the site is taken down or moved. Many change their content proactively, removing the infringing material just long enough to have a complaint dismissed, then reinstating it.

Capture everything the moment you find it. Do not wait.

The practical checklist:

• Take timestamped full-page screenshots immediately
• Save the full HTML source and generate a hash
• Run a WHOIS lookup and save the output
• Capture DNS records
• Generate a HAR file
• Archive the URL via the Wayback Machine at archive.org, which creates a publicly accessible snapshot with a timestamp

The Wayback Machine submission is particularly useful because it creates a third-party record that neither you nor the infringer controls, which adds weight to your evidence package.

If you are managing multiple infringements simultaneously, a structured evidence file for each case, organised by domain and date, makes the enforcement process significantly faster. Remove.tech's counterfeit listing detection and documentation guide covers how to structure that file for marketplace submissions specifically.

Putting It Together: The Evidence Package

A complete evidence package for a platform, registrar, or legal team typically includes:

• Timestamped full-page screenshots with the URL visible
• The HAR file from the session
• SHA-256 hash of the saved HTML with the capture date
• WHOIS and DNS snapshots
• Wayback Machine archive link
• A brief written summary identifying the specific infringement and your rights

Before you submit, it is worth understanding why takedown requests get rejected. The most common reasons are avoidable with the right evidence package.

FAQ

What is the most important piece of evidence when reporting a fake shop?

A timestamped screenshot showing the full URL and infringing content is the minimum requirement for most platforms. Pair it with a WHOIS snapshot and a page hash to build a stronger case.

Do I need a HAR file for every takedown?

Not always. HAR files are most useful when reporting to hosting providers or when the site is using a CDN to hide its infrastructure. For straightforward marketplace reports, screenshots and listing URLs are usually sufficient.

What if the fake shop changes its content after I find it?

Capture everything immediately and submit the Wayback Machine archive link as part of your evidence. This creates a third-party timestamp that the operator cannot alter.

Can I use a phone screenshot as evidence?

You can, but it is weaker than a browser-based capture. Phone screenshots rarely show the full URL, lack embedded metadata, and do not capture the full page. Use a desktop browser with a full-page capture tool where possible.

How does Remove.tech handle evidence collection?

Remove.tech's brand protection platform monitors for infringements around the clock and documents findings in real time. When an infringement is detected and validated, the evidence is structured and submitted as part of the takedown process, reducing the manual work for your team. You can learn more at remove.tech brand-protection.

Where can I find out more about building a complete evidence file for marketplace complaints?

Remove.tech's guide on detecting, documenting, and removing counterfeit listings covers the full process, including how to structure your evidence for specific platforms.

If fake shops are appearing faster than you can document them manually, Remove.tech's brand protection platform automates detection and structures evidence as part of the same workflow, so nothing gets missed before you act.

‍