Lion Cipher Lab

Pivot on a favicon hash to find related adversary infrastructure

• Threat Intel Analyst
• Intermediate
• ~45 min
• Free · no account required

Why it matters

A lot of threat-intelligence work is not about one malicious server — it is about finding the OTHER servers that belong to the same operation before they are used against you, which is called PIVOTING: taking one small thing you can observe and using it to discover related infrastructure. One of the most approachable pivots is the favicon hash. A FAVICON is the tiny icon a website serves for its tab and bookmarks, usually at /favicon.ico; a phishing kit, a malware command-and-control (C2) panel, or an off-the-shelf admin login page tends to ship the SAME favicon everywhere it is deployed,…

What you'll learn

• defining the plain-language terms this technique rests on — favicon, hash, MurmurHash3, base64, Shodan, Censys, and what 'pivoting' on an indicator means
• reproducing Shodan's favicon-hash algorithm yourself in Python: mmh3.hash(base64.encodebytes(raw_favicon_bytes)), signed 32-bit
• installing mmh3 with pip and confirming it works fully offline after the install — no API key, no account, no scanning
• computing the hash over a favicon file you already have locally and matching a reference value so you KNOW your implementation is correct
• proving to yourself that a different image yields a different hash (the before/after that validates the function)
• reading the operational pivot query form — Shodan http.favicon.hash:<N> and Censys services.http.response.favicon_hash:"<...>" — as a clearly-labelled OPTIONAL web step
• naming, out loud, why this is a WEAK high-false-positive signal: default/CDN favicons, trivial evasion, and hash collisions
• the pro workflow: corroborate a favicon cluster with JARM, TLS certificate fields, and ASN/prefix before acting on it, and never attribute on a favicon alone

Steps in this lab

1. The idea: turn one favicon into a list of related servers
2. What the number actually is: MurmurHash3 over base64 of the raw bytes
3. Install mmh3 (one command, then fully offline)
4. Get a favicon onto your disk — your own, or a local file
5. Write the hash function and compute your first favicon hash
6. Prove it is correct: reproduce it twice, and show a different image differs
7. OPTIONAL web step: the pivot query in Shodan and Censys
8. When NOT to trust this — favicon hashing is a WEAK signal
9. Do it better — corroborate with JARM, certs, and ASN before you act

Open the full interactive lab →