Knock-offs are a particularly big problem in the electronic cigarette industry, so many of the device manufacturers already do something like this - usually a code on the device or behind a scratch-off panel on the box (ie somewhere you can't read it without obvious tampering), then a form on their website that tells you whether the code is one of theirs, and if so, whether it's been submitted before (to catch knock-offs copying a genuine code). Eg:

https://www.innokin.com/verify-device/ http://svoemesto.de/serialcheck/ https://qr.szkanger.com/check/ https://www.geekvape.com/authentication/