Favicon hash
A favicon hash is a fingerprint (usually MurmurHash3 of the base64 icon) of a site's favicon that lets investigators find other sites using the same icon, a common trait of phishing kits.
How it works
Search engines such as Shodan, FOFA and Censys index the mmh3 hash of favicons. Kits reuse the brand's icon, so one hash can reveal dozens of hosts of the same campaign.
PhishDestroy stores favicon hashes with each report and groups related domains by them.
Example from the PhishDestroy database
- trontrace.xyz: Domain sharing its favicon hash with other reported domains, first detected 2026-10-22.
- fortgs.com: Domain sharing its favicon hash with other reported domains, first detected 2026-10-22.
- correors.qpon: Domain sharing its favicon hash with other reported domains, first detected 2026-10-22.
How to protect yourself
- Compute the hash of a suspicious site's favicon and search for other hosts with it.
- Brands can monitor their own favicon hash to find impostors.