Skip to main content
Thirdwatchthirdwatch
Engineering

Verify Listing Images Before Trusting Them

Batch-check marketplace listing photos for AI-generation markers and missing camera data — before the listing goes live.

Sep 16, 2026 · 3 min read · 523 words
See the scraper →

AI-generated listing photos are a real fraud vector — metadata catches a large share of them. Thirdwatch's Image Provenance Checker checks media files for the strongest public authenticity signals — C2PA Content Credentials manifests, EXIF software tags, and embedded AI-generator markers — and returns a labelled verdict per file.

Skip the setup: Run this as a ready-to-go task on Apify — pre-loaded with the configuration from this guide.

Why verify listing images

Marketplace trust teams increasingly see AI-generated product and property photos. The first-pass check — does this image carry generator signatures or coherent camera EXIF — is exactly what metadata answers at scale.

A URL list returns per-image verdicts with the signals attached — the review queue writes itself.

The checker parses the file's metadata layers directly, so a URL in means a provenance verdict out — with the evidence attached.

How does this compare to the alternatives?

Approach Cost model Coverage Effort
verify.contentauthenticity.org Free One image, manual upload Doesn't scale
EXIF viewers / exiftool Free Metadata only, one file Manual per file
Thirdwatch Image Provenance Checker Pay per media row C2PA + EXIF + AI markers, bulk URL list in, verdicts out

Why this Actor

  • Real C2PA parsing — manifest count, labels, generator, signers, actions, assertions.
  • 30+ AI-generator signatures across EXIF, PNG text chunks, and embedded metadata.
  • Full EXIF extraction — camera make/model, timestamps, software tags.
  • aiSignals lists exactly which markers matched — the verdict is auditable.
  • Honest semantics — absence of signals is 'not detected', never 'proven human'.

How to do it in 3 steps

Step 1: Configure the input

Set the inputs as shown below — urls takes the targets, direct media URLs — JPEG, PNG, WebP, GIF and MP4 all work.

Step 2: Run the Actor

Run it from the console, the API, or the linked saved task. One dataset row is written per media item.

Step 3: Use the output

Each row carries hasC2PA, the parsed manifest details, EXIF fields, embedded text chunks, the matched aiSignals, and the aiLikely verdict.

{
  "urls": [
    "https://upload.wikimedia.org/wikipedia/commons/3/3f/JPEG_example_flower.jpg"
  ]
}

Each dataset row looks like:

{
  "url": "https://example.com/image.jpg",
  "format": "jpeg",
  "sizeBytes": 132518,
  "hasC2PA": true,
  "c2pa": {
    "manifestCount": 7,
    "labels": [
      "c2pa.claim",
      "c2pa.signature"
    ],
    "generators": [
      "Adobe Firefly"
    ]
  },
  "exif": {
    "Software": "Adobe Firefly"
  },
  "aiSignals": [
    "exif_software:Adobe Firefly"
  ],
  "aiLikely": true
}

What to watch for

A clean result means no detectable signals — metadata is easily stripped, so treat aiLikely: false as 'nothing found' rather than 'authentic'. C2PA manifests are parsed and reported, not cryptographically verified.

Related use cases

Run the Image Provenance Checker on Apify Store — pay per result, free to try, no credit card to test.

Frequently asked questions

What is C2PA / Content Credentials?

A signed manifest embedded by cameras and generators recording who made the file and how it was edited. `hasC2PA` tells you it's present; the `c2pa` block carries the parsed details.

Does it detect SynthID?

Pixel-domain SynthID can only be verified by Google's own tool. This Actor detects the C2PA/Content-Credentials layer that Imagen, Gemini, and Firefly embed — the strongest publicly checkable signal.

What does `aiLikely: false` mean?

No AI signals were found — not proof of a human origin. Re-encoding, screenshots, and social re-uploads strip metadata.

What counts as an AI signal?

EXIF software tags (Firefly, DALL-E), PNG chunks like Stable Diffusion `parameters` or ComfyUI `workflow`, and 30+ generator signatures — each match is listed in `aiSignals`.

Does it verify the C2PA signature cryptographically?

It parses and reports the manifest contents including signers; full certificate-chain verification is a separate step.

What file types work?

JPEG, PNG, WebP, GIF, and MP4 — C2PA manifests are read from JPEG APP11, PNG `caBX`, and MP4 `uuid` boxes.

Related

Try it yourself

100 free credits, no credit card.

About 30 real searches. Add the MCP to Claude or Cursor in two minutes.