What it detects01
What does 'Favicon Retrieval Error' indicate?
It indicates that the crawler failed to retrieve the favicon asset due to a network, DNS, or TLS-related error, preventing reliable favicon fingerprinting.
Favicon Host Not Resolvable
It indicates that the crawler failed to retrieve the favicon asset due to a network, DNS, or TLS-related error, preventing reliable favicon fingerprinting.
Also surfaces as:
Favicon TLS Certificate ErrorFavicon Retrieval TimeoutFavicon Connection RefusedFavicon TLS Handshake FailureFavicon Retrieval Unknown Error
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is this considered a risky signal?
While retrieval failures can be benign, they frequently appear in short-lived, misconfigured, or evasive infrastructures where static assets are intentionally or unintentionally inaccessible.
How analysts use it03
How should SOC analysts use this label?
Treat it as a confidence-reducing signal for favicon-based analysis and correlate it with other HTTP, DNS, or WHOIS indicators before drawing conclusions.
Often paired with:alert_only
Evidence shape
What Favicon Host Not Resolvable looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "favicon_retrieval_error",
"name": "Favicon Host Not Resolvable",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "malicious",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}Siblings
Peers in Favicon Behavior
16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Favicon Host Domain Risky
It represents the final threat classification of the domain hosting the favicon, derived from multiple risk signals, rep…
MaliciousCore
Favicon Domain Malware (Security Vendors)
It indicates that one or more reputable security vendors have classified the favicon host domain as associated with malw…
MaliciousCore
Favicon Domain Malware Source
It indicates that the domain hosting the favicon has been directly observed serving malware payloads, exploit code, or m…
MaliciousCore
High Favicon Hash Churn
It indicates that the favicon hash associated with a domain has changed over time, reflecting instability in the site's …
MaliciousCore
In the wild
See Favicon Host Not Resolvable fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.