It represents an aggregated assessment of lexical and structural risk indicators observed in the favicon URL and its hosting domain, summarizing how suspicious the URL structure appears.
The questions every analyst asks before acting on this signal.
It represents an aggregated assessment of lexical and structural risk indicators observed in the favicon URL and its hosting domain, summarizing how suspicious the URL structure appears.
The profile is derived from signals such as unencrypted HTTP usage, direct IP-based URLs, suspicious port numbers, punycode usage, suspicious TLDs, and high DGA-like characteristics in the favicon host domain.
Low risk indicates mostly standard URL structures, medium risk reflects one or more suspicious lexical traits, and high risk indicates multiple or strong lexical anomalies commonly associated with malicious or evasive infrastructure.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "favicon_url_lexical_risk_profile",
"name": "Medium Lexical Risk",
"group": "http_crawling_history",
"subgroup": "favicon_behaviour",
"direction": "malicious",
"evidence": {
"favicon_hash": "-1293291467",
"unique_hash_count_90d": 3,
"favicon_domain": "cdn-login-assets[.]top",
"hosting_type": "third_party",
"service_match": false
}
}16 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the favicon is served from a domain different from the analyzed website, implying third-party hosting.
It indicates that no favicon URLs were detected or recorded for the domain during crawling, preventing favicon-based fin…
It indicates that one or more reputable security vendors have classified the favicon host domain as associated with malw…
It indicates that the domain hosting the favicon has been directly observed serving malware payloads, exploit code, or m…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.