The logo is not the signal. Hosting origin, widget structure, requested action, clipboard behaviour and operating-system instructions reveal whether a verification flow is plausible.
Branding is easy to copy
A Cloudflare logo, checkbox and Ray ID can all be reproduced by an attacker. Visual similarity should trigger brand-context checks, not automatic trust or an automatic malicious verdict.
What legitimate Turnstile normally does
Cloudflare documents Turnstile as a widget embedded in a website or application. The client-side widget produces a token that the site validates on its server, and its browser resources are hosted under challenges.cloudflare.com. A visitor may occasionally click a checkbox, but the verification remains in the browser.
The boundary fake challenges cross
A verification page becomes a ClickFix lure when it asks the visitor to leave the browser workflow: open Windows Run, Terminal or PowerShell; paste concealed clipboard content; press Enter to “verify”; install an update; or retrieve a tool from an unrelated host. No legitimate human-verification widget needs a visitor to execute a system command.
Embedded browser interaction, expected vendor infrastructure and no request to run system tools.
Brand imitation plus clipboard-to-command instructions, concealed delivery or an unrelated verification host.
Evidence URL Radar correlates
- Whether the claimed vendor’s resources come from expected infrastructure.
- Whether the page is a small widget or a full-page imitation.
- Whether instructions mention keyboard shortcuts, terminals or run dialogs in any supported language.
- Whether an interaction causes a clipboard write or reveals command-like content.
- Whether scripts are concealed, delayed or retrieve instructions from unrelated services.
Why this reduces false positives
Turnstile is legitimately used on domains that Cloudflare does not own, so “Cloudflare branding on another hostname” is not enough. The verdict must distinguish an embedded widget served from the expected challenge infrastructure from a page that only imitates the design and then asks for unsafe system interaction.
Primary reference: Cloudflare’s Turnstile documentation describes the genuine widget and server-validation flow.