---
title: "Favicon Impersonation"
slug: "favicon-impersonation"
updated: 2026-09-03T13:01:57Z
published: 2026-09-03T13:01:57Z
canonical: "help.silentpush.com/favicon-impersonation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Favicon Impersonation

The Favicon Impersonation query identifies domains using a brand’s favicon without authorization to enhance the credibility of phishing or illegitimate domains.

#### Threat Actors use Favicons to:

- Increase the visual credibility of illegitimate domains.
- Enhance the realism of phishing attacks.
- Evade basic detection tools.
- Boost social engineering efforts.
- Maintain consistency across phishing domains.

### Execute a Favicon Impersonation Query

1. Go to **Reconnaissance > Favicon Impersonation**.
2. Click **Create New +**.
3. In the **Domain Name** box, enter the domain to investigate.
4. Click **Search**.
5. On the results page, click **Save** to store the results (this also saves your input parameters). You can then enable scheduling via the schedule menu if desired.

### Understand Favicon Impersonation Results

Results are displayed in a table with the following columns:

- **Scan Date**: Date and time of the scan.
- **Origin URL**: Originally scanned URL.
- **URL**: Final destination URL of the query.
- **Hostname**: Name of the domain.
- **Favicon Icons**: Image of the favicon.
- **Favicon Murmur3**: Murmur3 hash of the standard favicon.
- **Favicon2 Murmur3**: Murmur3 hash of an alternative favicon.

### Filter and Expand Results

1. Add or remove filters by selecting the icon next to B**asic Raw Data,** then choose preferences.
2. Select **Expand** on a result to view additional details.