Reflections on E-commerce Platforms – Part 3: eBay Seller Program

As promised, this part will talk about eBay during the years 2018–2023, what can be considered the golden era of eBay selling. I don’t know how everyone usually registers eBay seller accounts, but this is the method I personally used back in 2019:

Analyze the platform!

Whatever you do, knowing yourself and your enemy means winning every battle. The simplest way to understand what eBay checks first is to see which partners it integrates with. Specifically here: Google and hCaptcha, since both appear during the account registration process.

If you have more technical knowledge, press F12, check what URLs and JS files are being loaded, and try to understand them. Back then, there was no ChatGPT, no AI, and no widespread use of antidetect browsers, so understanding eBay’s JS (or any platform’s JS) was nearly impossible. The only way was reverse analysis, guessing based on keywords.

One thing was certain: since it uses Google and hCaptcha security, you had to pass those two first. For those familiar with F12, I suggest looking for keywords like mouse movement and keyboard event.

About the most common question: Do you need to fake IP, and how?

• “Running eBay requires VPS,”

• “Buy SSH for proper spoofing,”

• “Use IPv6 proxy for cheap eBay farming”…

Sound familiar?

How much money have you wasted on all that? Me personally: $ 5k from my wife credit card 🤣

VPS and SSH are datacenter IPs. Do normal people use datacenter IPs to create eBay accounts and sell? No. If they do (usually business sellers), they are automatically suspicious, may get flagged, and then you have to fix it. This applies not just to eBay, but also Amazon, Etsy, and basically any platform.

Now about IPv6 proxies. I’ll write a separate post on that, but do you know about WebRTC? If your IPv4 leaks through it, then all those “IPv6 spoofing tools” are useless. That’s why low-quality antidetect tools and proxy sellers often tell you to disable WebRTC. If they can’t fake it, they just block it and hope you don’t notice 🫩

Lesson learned: stick to Residential or Mobile IPs. Even if the IP changes, it’s fine. What matters is cookies, sessions, behavior. If the IP changes but stays within the same range/provider (like LTE), it’s not a problem.

Registration information

I won’t go too deep into this part because it’s sensitive. I don’t know how others do it, but in my family, from people in their 30s to 50s, everyone had eBay seller accounts paired with Pingpong (back then also Payoneer, Wise).

So what’s the common mistake?

Buying someone else’s personal information (illegal), and worse, buying info that was already used (possibly even suspended) on eBay. Not to mention those “SSN checking services” where no one really knows if they’re legit. eBay doesn’t have real-time access to government databases, so it can’t truly validate them (which leads to suspicious accounts when fake info is used).

What about phone numbers?

Using virtual phone numbers almost always leads to low limits (99.36%), similar to proxies flagged by hCaptcha. If using US numbers, I always prefer numbers registered in the same state as the personal info. Don’t ask why—I don’t know, I just want peace of mind.

Also, renting numbers for SMS can be risky. If that number was previously used for a suspicious account, your whole setup is gone.

Why do people browse niche items before upgrading to seller?

The answer is behavior history, commonly called “warm-up.” Actually, it doesn’t have to be the exact niche—you just need to browse. Because no normal person opens a completely clean browser, goes straight to eBay, registers, and upgrades to seller immediately. That rarely happens. If you’ve noticed, software like Vektor T13 (type 8 and above) automatically opens multiple websites after setup to “inject cookies.” This is similar to the 2021 method of using “seed cookies” for registering clone accounts.

After all this theory, I discovered a simple trick to register seller accounts directly (only applicable around 2019–2022):

Create a clean environment where you can register a Gmail without phone verification, then use that Gmail to click “Sign in as XXX” at the top right of eBay. You could directly register a seller account with limits of 5k – 10k – 15k. No need for complicated steps.

What does this prove?

At that time, eBay relied almost entirely on Google’s hidden security scoring. If you passed Gmail, you passed eBay. No need for warm-up or extra steps.

Why do legitimate sellers still get mass-banned?

This is the classic case of “better to kill wrongly than miss one.”

Like the YouTube crisis during COVID with fake view farming. If you compare compensating wrongly banned users vs paying fraudsters, any CEO would choose to ban everything first and deal with appeals later (and most Vietnamese creators can’t sue in the US anyway). eBay is the same.

• People using stolen credit cards made banks label the platform as high-risk.

• People selling fake items or shipping bricks instead of products drove away customers.

• People using fake tracking numbers damaged trust with shipping carriers and PayPal.

So eBay had no choice but to keep mass banning.

Honestly, it’s mostly Vietnamese hurting other Vietnamese, not foreigners. Even now, things like GitHub Edu blocking Vietnam or stricter edu.vn domains come from the same mindset of abuse.

So how does eBay track accounts so precisely?

Let me share a story from 2011 when I cheated AWS for free 1-year VPS. After getting banned, I created a new account with a different IP, but still got flagged.

I contacted support via live chat. The agent accidentally revealed that I had previously registered another account on the same device. When I denied it, she even read out my computer name. Then she realized the mistake and ended the chat immediately. Since then, platforms like Facebook, TikTok, and eBay only say vague things like “violating community standards.”

So how do they really track you?

Not just browser fingerprinting (which is outdated), but through hidden APIs provided by the browser itself.

Back in 2017, Chrome already had features to check installed software and system security—only recently revealed as “malware scanning.” Why does a browser need to act like an antivirus?

Then there are hardware devices (internal and external) accessible via Chrome flags. Anyone doing reverse engineering can see Chrome constantly interacting with the registry to collect system data.

Conclusion: It’s no longer just about antidetect browsers—it’s about faking the entire device

In the past, people thought using multiple VPS was enough. But VPS systems share the same hardware and network, just virtualized via ESXi or Proxmox, so their fingerprints are nearly identical.

To solve this, you should use this free tool:

https://machine.antidetect.cloud

It changes the entire virtual machine identity to make it as real as possible, helping you safely register and manage seller accounts instead of relying on VPS.

That’s all for eBay. See you in the next posts!