Thanks @lozzo. CheckPhish proactively indexes pages of popular brands. Since the engine can identify brand automatically, and we know assets of the test url vs that of real brand, it's easy to identify fake vs real page. Keying on brand in this way, helps us avoid false alarms.