Logo Matching joins Cloudflare’s Brand Protection suite
Phishing campaigns increasingly weaponize official brand assets to lend credibility to lookalike domains. Attackers frequently copy logos onto spoofed sites, which can make fraudulent pages nearly indistinguishable from legitimate ones. In response, Cloudflare has expanded its Brand and Phishing Protection suite with a new Logo Matching capability that detects unauthorized logo usage across scanned domains and sends immediate notifications when a match is found.
The feature addresses a common request from organizations already using Brand Domain Name Alerts, which was introduced in March 2023. That existing tool identifies confusable domains by analyzing DNS requests routed through Cloudflare’s 1.1.1.1 resolver. Once a suspicious domain is flagged, Cloudflare’s phishing scanner automatically collects technical data about the site — including SSL certificate details, HTTP request and response data, page performance metrics, and DNS records — which feeds a machine-learning model for phishing risk assessment. Logo Matching extends these scans with image recognition: the system crawls scanned domains and can identify logos even when images have been slightly modified or altered.
For administrators, detecting a known logo on a site with a suspect domain is a strong signal that the site is being prepared for malicious use. Organizations can layer Cloudflare Gateway policies on top of these detections to block employees from connecting to such sites.
How the scanning workflow operates
Configuring Logo Matching generally starts with Domain Name Alerts. An alert set for example.com, for instance, uses fuzzy matching to catch lookalike, high-risk domains. Every site that triggers an alert is automatically run through the phishing scanner.
Beyond alert-triggered scans, Logo Matching monitors images across all domains scanned by Cloudflare’s phishing scanner. This includes domains scanned by other Brand Protection users, URLs submitted through the Cloudflare Radar URL scanner, and investigations initiated via the Investigate Portal in Security Center. Once configured, Domain Name Alerts and their associated scans run continuously.
Architecture of the Logo Matching engine
API submission and query handling
The Brand Protection API coordinates the entire matching process. Users submit logos or brand images through this API, and the system not only returns potential matches but also allows customers to save queries for later reference. Saving a query stores the logo in Cloudflare’s R2 object storage, which enables continuous, updated results without requiring repeated submissions of the same logo.
The API generates an image look-back ID for each submission, supporting real-time responses while internal scanning pipelines process in the background. This identifier tracks each submitted image so the system can manage and process them efficiently.
Result retrieval
Scan results are delivered through the same API. While scanning is in progress, the API reports a “still scanning” status. Once complete, it returns details on any matches found or a simple “no matches” declaration.
Logo data persistence and synchronization
For saved queries, the system maintains a vectorized version of uploaded logos. A logo matching subscriber component handles the ongoing accuracy of matches through two processes. First, it stays synchronized with revisions in the logo set: vectorized logos are saved with every update, and regular checks confirm alignment between the vectorized forms and those stored in the database. Second, while monitoring a query, the subscriber uses a diff-based strategy to recalibrate the vectorized logo set against current database entries, allowing smooth transitions during processing.
Planned enhancements
Cloudflare’s roadmap for the Brand Protection suite includes automated cease and desist letters for faster legal response to unauthorized logo use, proactive domain monitoring at onboarding, and simplified processes for reporting brand impersonation. Enterprise customers can request Beta Access for private domain scanning, logo matching, saved queries, and alerts on matched domains.
