What it detects01
What does 'Favicon Hash Changed Recently' indicate?
It indicates that a recent change occurred in the favicon hash associated with the domain, highlighting short-term instability in favicon usage.
Favicon Hash Recently First Seen
It indicates that a recent change occurred in the favicon hash associated with the domain, highlighting short-term instability in favicon usage.
Also surfaces as:
Favicon Hash Retired Recently
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
What is the difference between the sublabels?
'Recently First Seen' indicates a new favicon hash appearing for the first time, while 'Retired Recently' indicates a previously used favicon hash being abandoned.
How analysts use it03
Why is this considered a risky signal?
Recent favicon changes often accompany new deployments, infrastructure changes, or evasive behavior, and should be evaluated alongside other instability indicators.
Often paired with:alert_only
Evidence shape
What Favicon Hash Recently First Seen looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "favicon_hash_changed_recently",
"name": "Favicon Hash Recently First Seen",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "malicious",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}Siblings
Peers in Favicon Behavior
16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Favicon Hash Change Burst Window
It indicates that multiple favicon hash changes occurred within a short time window, reflecting sudden instability in fa…
Malicious
Favicon Hash Periodic Rotation Pattern
It indicates that favicon hashes change following a regular or repeating time pattern, suggesting automated or scheduled…
Malicious
High Favicon Hash Churn
It indicates that the favicon hash associated with a domain has changed over time, reflecting instability in the site's …
MaliciousCore
Stable Single Favicon Hash
It indicates that only one favicon hash has been observed for the domain and that the hash has not changed across multip…
Safe
In the wild
See Favicon Hash Recently First Seen fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.