What it detects01
What does 'Favicon Service Match' indicate?
It indicates that the page content is consistent with other websites sharing the same favicon fingerprint, suggesting legitimate reuse of a known service or platform template.
Favicon Service Content Match
It indicates that the page content is consistent with other websites sharing the same favicon fingerprint, suggesting legitimate reuse of a known service or platform template.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is this considered a safe signal?
When favicon fingerprinting and page content align, it reduces the likelihood of spoofing or deceptive template reuse, which is commonly observed in phishing or fraudulent infrastructures.
How analysts use it03
How should SOC analysts use this label?
Use it as a supportive safe-context signal to lower suspicion when no stronger malicious indicators are present, but do not treat it as definitive proof of legitimacy.
Evidence shape
What Favicon Service Content Match looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "favicon_service_match",
"name": "Favicon Service Content Match",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "safe",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}Siblings
Peers in Favicon Behavior
16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Favicon Service Content Mismatch
It indicates that the favicon fingerprint matches a known service or platform, but the page content does not align with …
Malicious
High Favicon Hash Churn
It indicates that the favicon hash associated with a domain has changed over time, reflecting instability in the site's …
MaliciousCore
Stable Single Favicon Hash
It indicates that only one favicon hash has been observed for the domain and that the hash has not changed across multip…
Safe
Favicon Domain Malware (Security Vendors)
It indicates that one or more reputable security vendors have classified the favicon host domain as associated with malw…
MaliciousCore
In the wild
See Favicon Service Content Match fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.