Favicon Hasher – An Osint Tool

kriztalz.sh

29 points·PranaFlux··9 comments

An older post on HN regarding favicon role in osint:

https://news.ycombinator.com/item?id=42774291

And the linked post on osintme.com:

https://www.osintme.com/index.php/2025/01/20/the-importance-...

Weird. It's exactly what it says, but I don't see how it's useful. I guess a lot of people reuse assets between sock puppet sites?

I've used favicons (along with analytics IDs) to identify related malicious sites. You can also apply this to detect brand abuse and phishing pages.

This free online tool helps you analyze website favicons and generate various hash formats used by popular search engines and security tools. Enter a domain or URL below to analyze its favicon.

Seems nice. I've tried a couple examples and compared them to other websites like it, it works better. I don't have a Shodan account so I can't check it works well with it.

What do you guys think?

I used to use this method, among others, to fingerprint Tor nodes. I used murmurhash3 so it was compatible with shodan, too.

To the comment - you're showing [dead]

> i'm curious, fingerprint in what way/purpose? all the relays are publicly listed by the Tor Project, so i'm guessing you mean something other than "x computer is a tor node"

I understand the confusion. I was typing fast. I meant Tor hidden services. I ran a service called torwhois that collected data and shared it.

I thought Tor hidden services couldn't be enumerated?

I was able to enumerate them in a few ways: Public repositories, DNS leaks, and people searching the service for onions.

I wish it didn't select the Apple Touch Icon when there was also a favicon

Reply on news.ycombinator.com