Web Scanner allows users to target the favicon data of a webpage in a number of ways, allowing security teams to scan for similair websites.

Here's an explanation of useful data types. Click here for a full list of field names.

Favicon data

Field names

• favicon_md5
• favicon_murmur3
• favicon_path
• favicon2_md5
• favicon2_murmur3
• favicon2_path
• favicon_urls

Explanation

The fields favicon_md5 and favicon_murmur3 refer to .ico favicons exclusively, typically sourced from https://example.com/favicon.ico, though variations may exist as indicated by favicon_urls.

favicon2_md5 and favicon2_murmur3 reference favicons not in .ico format. These favicons are commonly in PNG or JPG format.

The "2" in favicon2 denotes a different type of favicon, rather than a sequence or order. It's common for websites to possess both types of favicons.

Occasionally, there may even be three different favicons, including an unreferenced root-favicon located at /favicon.ico.

This root-favicon doesn't require explicit referencing in the page code since browsers automatically check for it, as does the scanner.