What it detects01
What does 'Favicon Third-Party Hosted' indicate?
It indicates that the favicon is served from a domain different from the analyzed website, implying third-party hosting.
Favicon Hosted on CDN
It indicates that the favicon is served from a domain different from the analyzed website, implying third-party hosting.
Also surfaces as:
Favicon Hosted on Legitimate Third-Party
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
How should the sublabels be interpreted?
'CDN Hosted' reflects common and benign asset delivery, while 'Legitimate Hosted' reflects recognized third-party services used for static resources.
How analysts use it03
How should SOC analysts use this label?
Use it as a contextual, safe-leaning signal. It should not increase risk on its own but can provide helpful context when evaluating other favicon or URL anomalies.
Evidence shape
What Favicon Hosted on CDN looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "favicon_third_party_hosted",
"name": "Favicon Hosted on CDN",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "safe",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}Siblings
Peers in Favicon Behavior
16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Favicon URLs Missing or Empty
It indicates that no favicon URLs were detected or recorded for the domain during crawling, preventing favicon-based fin…
Malicious
Medium Lexical Risk
It represents an aggregated assessment of lexical and structural risk indicators observed in the favicon URL and its hos…
Malicious
Favicon Domain Malware (Security Vendors)
It indicates that one or more reputable security vendors have classified the favicon host domain as associated with malw…
MaliciousCore
Favicon Domain Malware Source
It indicates that the domain hosting the favicon has been directly observed serving malware payloads, exploit code, or m…
MaliciousCore
In the wild
See Favicon Hosted on CDN fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.