Web-forensics use case
Acquire bulk web evidence through country-specific proxies
Eviquire supports documented bulk acquisition of a defined URL list through controlled Web or SOCKS proxy routes, including approved country-specific exits. Every URL discovered by the crawler can be acquired through all proxies configured in Eviquire for the acquisition. It can also collect multipage results from a search engine, portal, marketplace, or authorized dark-web shop and acquire each eligible linked result or product page individually.
What this use case means
Eviquire supports documented bulk acquisition of a defined URL list through controlled Web or SOCKS proxy routes, including approved country-specific exits. Every URL discovered by the crawler can be acquired through all proxies configured in Eviquire for the acquisition. It can also collect multipage results from a search engine, portal, marketplace, or authorized dark-web shop and acquire each eligible linked result or product page individually.
Web content can vary by apparent location, language, currency, account, cookies, search parameters, availability, personalization, advertising, inventory, and time. Large result sets add pagination, duplicate listings, promoted results, lazy loading, redirects, missing pages, and rate or access controls. A defensible comparison therefore needs a predefined URL-and-country matrix, controlled settings, a recorded proxy route, repeatable stopping rules, and explicit documentation of failures and source-imposed limitations.
Common situations
When this workflow is useful
- Comparing how the same defined webpages, offers, advertisements, prices, claims, or availability are presented through approved proxy exits in different countries
- Acquiring every eligible page of a portal or search-engine result set generated from a documented search term, filters, order, language, and date
- Extracting and individually preserving product or listing pages returned across multiple search-result pages—for example, an authorized marketplace investigation involving eBay or a similar platform
- Collecting authorized dark-web shop category, search-result, and product pages through an approved Tor-compatible proxy route and controlled environment
Recommended process
A documented acquisition workflow
- Define the acquisition matrix
List the target URLs or search workflows, all proxies configured in Eviquire for the acquisition, authorized countries or access routes, account state, language, currency, user agent, date or time window, repetition count, exclusions, and stopping rules before collection.
- Validate proxies and the controlled browser state
Confirm each approved Web or SOCKS proxy route, including any Tor-compatible route required for an authorized onion service, record its configuration identifier without exposing credentials, and standardize cookies, cache, account, locale, timezone, browser profile, and other settings that could affect the comparison.
- Select the bulk acquisition mode
Use sequential bulk URL acquisition for a supplied URL list. For a searchable portal or shop, record the search term and filters, then configure multipage collection using the eligible Next control or other supported pagination behavior.
- Acquire result pages systematically
Preserve the first result page and continue through the defined page limit or stopping condition. Record result order, promoted or sponsored entries, duplicate items, lazy-loaded content, redirects, unavailable pages, and any page where the expected navigation control was absent or changed.
- Extract and acquire linked detail pages
Where supported and authorized, identify eligible result or product links and acquire each detail page individually. This can preserve every in-scope listing returned by a multipage eBay search or, through an approved dark-web acquisition environment, the eligible product pages returned by a dark-web shop.
- Acquire every URL through all configured proxies
Configure the routing matrix so that each supplied or crawled URL is acquired once through every proxy in the Eviquire acquisition configuration. Keep every URL-and-proxy attempt separately identifiable, including successes, failures, redirects, route details, and timestamps, rather than silently merging the results.
- Compare, verify, and report
Review successes, failures, redirects, regional or route-dependent differences, files, screenshots, page artifacts, activity history, hashes, timestamps, and proxy context. Preserve the original evidence packages and explain which differences were observed, which variables were controlled, and which conclusions require corroboration.
Technical guidance
Conditions that affect geographic and multipage bulk acquisition
Validate the proxy routes, result-page behavior, detail-link extraction, stopping rules, and evidence outputs before starting a large formal collection.
Three distinct bulk workflows
Eviquire supports a defined sequence of URLs, multipage or paginated result collection, and product-listing link extraction with individual detail-page acquisition. These modes can be combined, but the report should distinguish the supplied URLs, result pages, and extracted detail pages.
- URL list: acquire a predefined sequence of addresses.
- Result pagination: follow a supported, investigator-defined Next control across result pages.
- Detail acquisition: extract eligible product or record links and preserve each page separately.
Configured proxy fan-out and country-specific routing
Eviquire can apply all proxies in the acquisition configuration to every URL in the crawl: each supplied or discovered URL is acquired separately through every configured proxy. An approved Web or SOCKS proxy may represent a country-specific exit, a controlled corporate route, or a Tor-compatible route for an authorized onion service. Record the configuration identifier, expected route, validation time, and failures without storing proxy credentials in the evidence narrative.
- Validate every configured route before formal acquisition.
- Preserve each URL-and-proxy attempt as an independently identifiable result.
- Record direct, country proxy, corporate proxy, VPN, and Tor conditions accurately; do not describe them as interchangeable.
Search and portal result pages
A search engine or portal can return different results according to the exact query, filters, sorting, account, language, region, cookies, experimentation, advertising, and time. Preserve the submitted term and configuration together with each result page.
- Record query text, filters, sort order, result count, page number, and visible region or currency.
- Identify sponsored or promoted results separately when visible.
- Document infinite scrolling, load-more controls, result caps, missing pages, duplicates, and changing order.
Product and detail-page extraction
On a marketplace such as eBay—or an authorized dark-web shop reached through the required controlled route—a multipage search can expose many individual product links. Where the platform, authority, source behavior, current product support, and approved configuration permit it, Eviquire can extract eligible listing links and acquire the corresponding product pages individually through every proxy in the acquisition configuration.
- Preserve the result page that linked to each product.
- De-duplicate repeated links while retaining a record of where they appeared.
- Record removed, redirected, unavailable, login-gated, route-blocked, or unsafe detail pages rather than implying complete acquisition.
Proxy trust, TLS, and network evidence
A proxy is part of the acquisition environment and may influence or technically mediate the traffic. Record the expected trust and certificate conditions. Available TLS metadata and optional packet-level capture with an approved Wireshark configuration can provide additional context, but neither automatically proves that a proxy was trustworthy or that content was unmodified.
- Investigate unexpected certificates, interception warnings, redirects, or content injection.
- Preserve relevant proxy and TLS context without exposing secrets.
- Distinguish source behavior from changes potentially introduced by the network path.
Rate limits, terms, and collection boundaries
Bulk collection must remain within the investigator's authority and the approved technical procedure. Source terms, robots controls, authentication, access limits, anti-automation mechanisms, privacy rules, and system stability can restrict or stop a workflow.
- Do not bypass access controls, CAPTCHAs, blocks, or technical safeguards without separate lawful authority and an approved method.
- Use conservative pacing and a pre-agreed maximum page or item count.
- Preserve failure and partial-acquisition records instead of repeatedly escalating requests without review.
Interpreting geographic differences
The acquisition establishes what a specific controlled session received through a recorded route at a recorded time. It does not prove that the publisher intentionally targeted a country, that every resident saw the same content, that the proxy endpoint was physically where advertised, or that the source server originated there.
- Repeat important observations where proportionate.
- Corroborate material differences with additional routes, provider records, source settings, direct observations, or server-side evidence where available.
- Separate captured facts from conclusions about targeting, discrimination, availability, pricing, or publisher intent.
Reviewable output
What the evidence package should explain
Acquisition matrix
Target URLs or query workflows, selected Eviquire proxy configurations, controlled browser settings, sequence, timing, exclusions, and stopping rules.
Result and detail pages
Paginated search, portal, marketplace, or authorized dark-web shop results, extracted product or record links, individually acquired detail pages, and their source relationships.
Routing and execution record
A separately identifiable result for every URL-and-proxy combination, including route context, redirects, failures, retries, activity history, optional network evidence, and changes between runs.
Comparison and integrity package
Route-dependent observations, screenshots, page artifacts, hashes, timestamps, chain-of-custody records, and a report that separates evidence from interpretation.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Confirm legal authority, platform access rights, proxy or Tor use, privacy obligations, data-transfer implications, and proportionality before collecting across countries, marketplaces, or dark-web services at scale.
- Dark-web shop acquisition requires an isolated, authorized, risk-assessed environment and approved operational-security, malware, prohibited-content, download, and interaction procedures. Do not transact, communicate, or download beyond explicit authority.
- Do not claim that a proxy exit proves physical location, publisher origin, deliberate geographic targeting, market-wide availability, or what every user in that country would see.
- Search and marketplace results can be personalized, sponsored, duplicated, reordered, capped, or changed during collection. Preserve the exact query and settings and report any condition that prevents a completeness claim.
- Bulk collection can impose load on third-party systems. Use defined scope, conservative pacing, validated stopping rules, and documented failure handling rather than attempting to defeat source safeguards.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can Eviquire acquire a predefined list of URLs in bulk?
Yes. Eviquire supports sequential acquisition of a defined URL list, with the resulting pages and acquisition activity preserved according to the selected workflow and configuration.
Can every crawled URL be acquired through all configured proxies?
Yes. Eviquire can acquire each supplied or crawler-discovered URL separately through every proxy present in the Eviquire configuration for that acquisition. Each URL-and-proxy attempt should remain identifiable so successes, failures, redirects, route context, and differences can be reviewed.
Can Eviquire collect every page of a multipage search result?
It can process supported paginated result pages using a defined Next control or compatible crawling workflow. The investigator must specify the query, filters, page limit, stopping condition, and any unavailable or changing pages.
Can Eviquire acquire every product page returned by a marketplace search?
Where the platform, authorization, source behavior, current product support, and configuration permit it, Eviquire can extract eligible product-listing links from multipage results and acquire each linked page separately. This can support a defined eBay or similar marketplace investigation without implying unrestricted or complete platform acquisition.
Does the same workflow support dark-web shops?
Yes, when the shop is lawfully accessible through an approved Tor-compatible proxy configured in Eviquire and the collection is performed in an isolated, risk-assessed environment. Eviquire can preserve supported multipage category or search results and individually acquire eligible product pages through every proxy in the acquisition configuration, subject to explicit authority and operational-security controls.
Can a different proxy be used for each country?
Approved Web or SOCKS proxy configurations can be used to conduct separately documented runs through selected country-specific exits. Each route and run should be validated, identified, and reported independently.
Does a country-specific proxy prove what all users in that country see?
No. It records what one controlled session received through that route at that time. Personalization, account state, cookies, language, advertising, inventory, experimentation, proxy quality, and source behavior can produce different results.
Should search-result pages and product pages both be preserved?
Yes when both are relevant. The result pages document the query, ordering, pagination, and link context; the individual detail pages preserve the content of each selected listing or record.
What happens when a page fails or the portal blocks the collection?
Preserve the failure, time, route, error, partial artifacts, and any approved retry. Do not conceal missing pages or bypass access controls without separate lawful authority and an approved procedure.
Can geographic differences prove intentional targeting?
Not by themselves. The acquisition documents observed differences. Intent, targeting rules, publisher control, and geographic causation require corroborating evidence and qualified analysis.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
OSINT analysts
Connect volatile online findings to their sources, time, collection method, and integrity records.
See role-specific guidance →
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law enforcement
Preserve volatile online evidence for authorized criminal and intelligence investigations.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →