A mail transfer agent comprises processing circuitry, storage circuitry, and networking circuitry. The storage circuitry holds a database. The networking circuitry is operable to receive, via a network connection, an email message. The processing circuitry is operable to analyze the email message to detect an image present in the email message. The processing circuitry is operable to determine, based on one or more records of the database, that the detected image is associated with a particular brand, and process the email message based on whether one or more characteristics of the email message are associated with the particular brand in the database. The one or more characteristics of the email message may comprise one or more of: sender domain, sender subdomain, and sender IP address.