This article presents a script analysis of the distribution of counterfeit alcohols across two European jurisdictions. Based on an analysis of case file data from a European regulator and interviews with investigators, the article deconstructs the organisation of the distribution of the alcohol across jurisdictions into five scenes (collection, logistics, delivery, disposal, proceeds/finance) and analyses the actual (or likely permutations of) behaviours within each scene. The analysis also identifies underlying and routine activities and processes connecting each scene at the intersections of licit and illicit markets and networks as we see the ‘integration’, ‘incorporation’, ‘de-integration’ and ‘allocation’ of the illicit product at various stages and under particular conditions. Furthermore, the article analyses the required resources, equipment and relations of the distribution in addition to examining the actors involved by utilising a social network analysis to link specific actors to specific roles in specific scenes. Likely deception points in the script are presented in order to inform the intervention and disruption strategies of the regulator. Our core argument is that in this case, distribution is most vulnerable where the illicit product is integrated into and then de-integrated out of the licit system and that increased capable guardianship is necessary at these critical points.