The technology described herein uses data in certificate transparency (CT) logs to identify security certificates that are likely to be used for phishing or brand violation. The technology described uses machine vision technology to analyze the domain name in a CT log as a user would view it. The domain name in the CT log is rendered as it might appear in a web browser's address bar. The rendered domain name is then converted to a text string using optical character recognition (OCR). The text string generated by OCR is then analyzed by a brand detection system to determine whether the text string matches a brand name. When a known brand is detected, a trust analysis is performed to determine whether the security certificate in the CT log is actually associated with the brand.