It indicates that the favicon fingerprint matches a known service or platform, but the page content does not align with that service, suggesting inconsistent or deceptive template usage.
The questions every analyst asks before acting on this signal.
It indicates that the favicon fingerprint matches a known service or platform, but the page content does not align with that service, suggesting inconsistent or deceptive template usage.
Attackers frequently reuse favicons from legitimate services while serving unrelated or malicious content, making favicon-content mismatch a common indicator of spoofing or phishing infrastructure.
Treat it as a strong suspicion signal and correlate it with other HTTP, DNS, or reputation indicators before escalating to a malicious verdict.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "favicon_service_mismatch",
"name": "Favicon Service Content Mismatch",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "malicious",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the page content is consistent with other websites sharing the same favicon fingerprint, suggesting le…
It indicates that the favicon hash associated with a domain has changed over time, reflecting instability in the site's …
It indicates that only one favicon hash has been observed for the domain and that the hash has not changed across multip…
It indicates that one or more reputable security vendors have classified the favicon host domain as associated with malw…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.