Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

OSINT

Recover origin IPs behind a CDN from a favicon

favup is an OSINT tool that finds a host's real IP address by hashing its favicon and searching Shodan for other servers serving the same icon, exposing origins hidden behind CDNs and firewalls.

installgit clone https://github.com/pielco11/fav-up.gitpip3 install -r requirements.txt

Python · MIT license

Agent
Reach the origin behind Cloudflare or a CDNResolve real IPs for a list of domainsSearch the internet by a known favicon hash

overview

What favup does

favup hashes a site favicon and queries Shodan for matching hosts. When Cloudflare or another CDN hides the front-end IP, the origin often still serves the same icon, so the hash can surface the real address.

Start from -wl domains, -ul icon URLs, -fu or -ff a single icon, or -fh a precomputed hash. Pass the Shodan key with -k or -kf.

Trickest exposes it as a managed OSINT node that writes a folder and a file. Feed recovered IPs into naabu or httpx for direct probing. Prefer favfreak for list-wide tech clustering and dorks instead of origin lookup.

source github.com/pielco11/fav-up

use cases

Where favup fits

Reach the origin behind Cloudflare or a CDN

Hash the favicon and search Shodan to recover the origin IP behind a site fronted by Cloudflare, another CDN, or a WAF, so testing can target the real server instead of the front end.

Resolve real IPs for a list of domains

Feed a file of domains with -wl and let favup look up the origin for each one, building a map of hosts and the IPs that serve them.

Search the internet by a known favicon hash

Supply a precomputed favicon hash with -fh and query Shodan across the whole internet to surface every host serving that exact icon, including mirrors and staging copies.

Feed recovered origins into direct scanning

Pass the origin IPs into a port scanner such as naabu or a prober so the rest of the workflow hits the origin directly, bypassing the protective front end.

reference

favup inputs and flags

9 inputs
NameTypeFlagDescription
web-listFILE-wlFile listing the domains to look up.
favicon-webSTRING-wSingle domain to look up when you know it serves a favicon but not the icon's URL.
url-listFILE-ulFile listing the full URLs of all icons to look up.
favicon-urlSTRING-fuURL where the favicon resides.
favicon-hashSTRING-fhPrecomputed favicon hash to search across the whole internet.
favicon-fileFILE-ffLocal favicon file to hash and look up.
api-keySTRING-kShodan API key passed inline.
api-key-fileFILE-kfFile to read the Shodan API key from.

Showing key inputs. favup exposes 9 inputs in total.

Full flag reference (9 inputs)
NameTypeFlagDescription
api-keySTRING-kShodan API key passed inline.
url-listFILE-ulFile listing the full URLs of every icon to look up.
web-listFILE-wlFile listing the domains to look up.
favicon-urlSTRING-fuURL where the favicon resides.
favicon-webSTRING-wDomain to look up when you know it serves a favicon but not the icon's URL.
api-key-fileFILE-kfFile to read the Shodan API key from.
favicon-fileFILE-ffLocal favicon file to hash and look up.
favicon-hashSTRING-fhPrecomputed favicon hash to search across the whole internet.
favicon-listFILE-flFile listing the full paths of all local icons to look up.

example

Run favup

favup · command
# recover the origin IP behind a CDN from a domain's favicon
python3 favUp.py -w example.com -k <shodan-api-key>
sample output
[+] Loaded Shodan API key
[+] example.com -> favicon hash: -1655836657
[+] Querying Shodan: http.favicon.hash:-1655836657
[+] Found 3 host(s) for example.com
      198.51.100.23
      198.51.100.24
      203.0.113.9
[+] Results written to favup-results.json

guidance

Choosing favup

Use when a host sits behind a CDN or WAF and you need an origin IP from Shodan favicon matches. Requires a Shodan key. For list-wide favicon fingerprinting, use favfreak.

favfreak

Hashes favicons to fingerprint tech and build Shodan dorks. favup resolves the origin IP behind one.

hakoriginfinder

Finds origin servers by comparing responses. A different signal than favup favicon-hash lookup.

shodan-python

General Shodan querying. favup wraps the favicon-hash origin lookup specifically.

faq

favup questions

It hashes the target favicon and queries Shodan for http.favicon.hash matches. A server behind Cloudflare usually still serves the same favicon on its origin IP, and if that origin is public, Shodan has often indexed it.

Yes. Pass a key inline with -k or point at a file with -kf. Every lookup runs through Shodan, so results reflect what Shodan has indexed for that favicon. The Trickest node exposes -k and -kf.

A domain with -w, a file of domains with -wl, a file of icon URLs with -ul, a single favicon URL with -fu, a local favicon file with -ff or a list with -fl, or a precomputed favicon hash with -fh.

Yes. Give favup a precomputed mmh3 hash with -fh and it queries Shodan across indexed hosts serving that icon, without needing a domain. Useful for finding mirrors, staging copies, and hosts that reuse the same icon.

No. It only works when the origin is reachable on the public internet, still serves the same favicon as the fronted site, and has been indexed by Shodan. If the origin is firewalled to CDN ranges or serves a different icon, the lookup returns nothing.

Feed the recovered IPs into port scanning or direct probing so testing hits the origin instead of the front end. In a Trickest workflow, wire favup into naabu or httpx against the IPs it surfaces.

related

More OSINT tools

  1. dnsdumpster-dns-lookup

    Passive DNS records from DNSDumpster.

  2. dnstwist

    Generate lookalike domains and flag registered typosquats.

  3. Infoga

    Email OSINT from public sources, with optional breach checks.

  4. maigret

    Username search that collects accounts and profile data into one dossier.

  5. socialscan

    Check whether emails and usernames are available, taken, or invalid.

  6. dnsdumpster-host-search

    Passive DNSDumpster host lookup by domain.

Run favup yourself

A domain list feeds favup, which resolves origin IPs via Shodan favicon hashes, then naabu port-scans them and writes the results as output.

Run favup in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.