loading
Loading content
loading
OSINT
Look up the real IP of a host from its favicon via Shodan.
overview
favup hashes a site favicon and queries Shodan for matching hosts. When Cloudflare or another CDN hides the front-end IP, the origin often still serves the same icon, so the hash can surface the real address.
Start from -wl domains, -ul icon URLs, -fu or -ff a single icon, or -fh a precomputed hash. Pass the Shodan key with -k or -kf.
Trickest exposes it as a managed OSINT node that writes a folder and a file. Feed recovered IPs into naabu or httpx for direct probing. Prefer favfreak for list-wide tech clustering and dorks instead of origin lookup.
source github.com/pielco11/fav-up
use cases
Hash the favicon and search Shodan to recover the origin IP behind a site fronted by Cloudflare, another CDN, or a WAF, so testing can target the real server instead of the front end.
Feed a file of domains with -wl and let favup look up the origin for each one, building a map of hosts and the IPs that serve them.
Supply a precomputed favicon hash with -fh and query Shodan across the whole internet to surface every host serving that exact icon, including mirrors and staging copies.
Pass the origin IPs into a port scanner such as naabu or a prober so the rest of the workflow hits the origin directly, bypassing the protective front end.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| web-list | FILE | -wl | File listing the domains to look up. |
| favicon-web | STRING | -w | Single domain to look up when you know it serves a favicon but not the icon's URL. |
| url-list | FILE | -ul | File listing the full URLs of all icons to look up. |
| favicon-url | STRING | -fu | URL where the favicon resides. |
| favicon-hash | STRING | -fh | Precomputed favicon hash to search across the whole internet. |
| favicon-file | FILE | -ff | Local favicon file to hash and look up. |
| api-key | STRING | -k | Shodan API key passed inline. |
| api-key-file | FILE | -kf | File to read the Shodan API key from. |
Showing key inputs. favup exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| api-key | STRING | -k | Shodan API key passed inline. |
| url-list | FILE | -ul | File listing the full URLs of every icon to look up. |
| web-list | FILE | -wl | File listing the domains to look up. |
| favicon-url | STRING | -fu | URL where the favicon resides. |
| favicon-web | STRING | -w | Domain to look up when you know it serves a favicon but not the icon's URL. |
| api-key-file | FILE | -kf | File to read the Shodan API key from. |
| favicon-file | FILE | -ff | Local favicon file to hash and look up. |
| favicon-hash | STRING | -fh | Precomputed favicon hash to search across the whole internet. |
| favicon-list | FILE | -fl | File listing the full paths of all local icons to look up. |
example
# recover the origin IP behind a CDN from a domain's faviconpython3 favUp.py -w example.com -k <shodan-api-key>[+] Loaded Shodan API key[+] example.com -> favicon hash: -1655836657[+] Querying Shodan: http.favicon.hash:-1655836657[+] Found 3 host(s) for example.com 198.51.100.23 198.51.100.24 203.0.113.9[+] Results written to favup-results.jsonguidance
Use when a host sits behind a CDN or WAF and you need an origin IP from Shodan favicon matches. Requires a Shodan key. For list-wide favicon fingerprinting, use favfreak.
Hashes favicons to fingerprint tech and build Shodan dorks. favup resolves the origin IP behind one.
Finds origin servers by comparing responses. A different signal than favup favicon-hash lookup.
General Shodan querying. favup wraps the favicon-hash origin lookup specifically.
faq
related
Passive DNS records from DNSDumpster.
Generate lookalike domains and flag registered typosquats.
Email OSINT from public sources, with optional breach checks.
Check whether emails and usernames are available, taken, or invalid.
Passive DNSDumpster host lookup by domain.
List public repositories for each GitHub username you already have.
A domain list feeds favup, which resolves origin IPs via Shodan favicon hashes, then naabu port-scans them and writes the results as output.
Facts on this page come from the live Trickest tool library.