What it detects01
What does 'Favicon Domain Newly Registered' indicate?
It indicates that the domain hosting the favicon was registered very recently relative to the observation time, meaning it has little to no operational history.
Favicon Domain Newly Registered
It indicates that the domain hosting the favicon was registered very recently relative to the observation time, meaning it has little to no operational history.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why does recent domain registration matter in favicon analysis?
Favicon assets are typically static and reused across deployments. When a newly registered domain hosts favicon resources, it often suggests freshly deployed or disposable infrastructure, which is common in phishing kits and short-lived malicious campaigns.
How analysts use it03
How should analysts interpret this signal?
This signal should increase suspicion when combined with low popularity, short uptime, or favicon instability. On its own, it does not prove malicious intent but indicates elevated risk due to lack of historical trust.
Often paired with:alert_only
Evidence shape
What Favicon Domain Newly Registered looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "favicon_domain_newly_registered",
"name": "Favicon Domain Newly Registered",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "malicious",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}Siblings
Peers in Favicon Behavior
16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Favicon Domain Malware (Security Vendors)
It indicates that one or more reputable security vendors have classified the favicon host domain as associated with malw…
MaliciousCore
Favicon Domain Malware Source
It indicates that the domain hosting the favicon has been directly observed serving malware payloads, exploit code, or m…
MaliciousCore
Favicon Domain Low Popularity
It indicates that the domain hosting the favicon has very low observed traffic, reputation, or backlink presence, sugges…
Malicious
Favicon Domain Short Time Up and Running
It indicates that the favicon host domain has been observed active for only a short operational window, with limited con…
Malicious
In the wild
See Favicon Domain Newly Registered fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.