OSINT
Recover origin IPs behind a CDN from a favicon
Look up the real IP of a host from its favicon via Shodan.
overview
What favup does
favup hashes a site favicon and queries Shodan for matching hosts. When Cloudflare or another CDN hides the front-end IP, the origin often still serves the same icon, so the hash can surface the real address.
Start from -wl domains, -ul icon URLs, -fu or -ff a single icon, or -fh a precomputed hash. Pass the Shodan key with -k or -kf.
Trickest exposes it as a managed OSINT node that writes a folder and a file. Feed recovered IPs into naabu or httpx for direct probing. Prefer favfreak for list-wide tech clustering and dorks instead of origin lookup.
source github.com/pielco11/fav-up
use cases
Where favup fits
Reach the origin behind Cloudflare or a CDN
Hash the favicon and search Shodan to recover the origin IP behind a site fronted by Cloudflare, another CDN, or a WAF, so testing can target the real server instead of the front end.
Resolve real IPs for a list of domains
Feed a file of domains with -wl and let favup look up the origin for each one, building a map of hosts and the IPs that serve them.
Search the internet by a known favicon hash
Supply a precomputed favicon hash with -fh and query Shodan across the whole internet to surface every host serving that exact icon, including mirrors and staging copies.
Feed recovered origins into direct scanning
Pass the origin IPs into a port scanner such as naabu or a prober so the rest of the workflow hits the origin directly, bypassing the protective front end.
reference
favup inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| web-list | FILE | -wl | File listing the domains to look up. |
| favicon-web | STRING | -w | Single domain to look up when you know it serves a favicon but not the icon's URL. |
| url-list | FILE | -ul | File listing the full URLs of all icons to look up. |
| favicon-url | STRING | -fu | URL where the favicon resides. |
| favicon-hash | STRING | -fh | Precomputed favicon hash to search across the whole internet. |
| favicon-file | FILE | -ff | Local favicon file to hash and look up. |
| api-key | STRING | -k | Shodan API key passed inline. |
| api-key-file | FILE | -kf | File to read the Shodan API key from. |
Showing key inputs. favup exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| api-key | STRING | -k | Shodan API key passed inline. |
| url-list | FILE | -ul | File listing the full URLs of every icon to look up. |
| web-list | FILE | -wl | File listing the domains to look up. |
| favicon-url | STRING | -fu | URL where the favicon resides. |
| favicon-web | STRING | -w | Domain to look up when you know it serves a favicon but not the icon's URL. |
| api-key-file | FILE | -kf | File to read the Shodan API key from. |
| favicon-file | FILE | -ff | Local favicon file to hash and look up. |
| favicon-hash | STRING | -fh | Precomputed favicon hash to search across the whole internet. |
| favicon-list | FILE | -fl | File listing the full paths of all local icons to look up. |
example
Run favup
# recover the origin IP behind a CDN from a domain's faviconpython3 favUp.py -w example.com -k <shodan-api-key>[+] Loaded Shodan API key[+] example.com -> favicon hash: -1655836657[+] Querying Shodan: http.favicon.hash:-1655836657[+] Found 3 host(s) for example.com 198.51.100.23 198.51.100.24 203.0.113.9[+] Results written to favup-results.jsonguidance
Choosing favup
Use when a host sits behind a CDN or WAF and you need an origin IP from Shodan favicon matches. Requires a Shodan key. For list-wide favicon fingerprinting, use favfreak.
favfreak
Hashes favicons to fingerprint tech and build Shodan dorks. favup resolves the origin IP behind one.
hakoriginfinder
Finds origin servers by comparing responses. A different signal than favup favicon-hash lookup.
shodan-python
General Shodan querying. favup wraps the favicon-hash origin lookup specifically.
faq
favup questions
related
More OSINT tools
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
dnstwist
Generate lookalike domains and flag registered typosquats.
Infoga
Email OSINT from public sources, with optional breach checks.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
dnsdumpster-host-search
Passive DNSDumpster host lookup by domain.
Run favup yourself
A domain list feeds favup, which resolves origin IPs via Shodan favicon hashes, then naabu port-scans them and writes the results as output.
Facts on this page come from the live Trickest tool library.