Favicon Hashes

Shodan allows favicon hash lookup with http.favicon.hash.
Hash refers to the MurrmurHash3 of the favicons file contents in base64.

Python3 Script for generating the hash:

import mmh3import requestsimport codecs

response = requests.get('https://<website>/<favicon path>')
favicon = codecs.encode(response.content, 'base64')hash = mmh3.hash(favicon)print(hash)

Another useful tool you can use is Fav-Up by pielco11.

Using this tool you can look up for real IP starting from the favicon icon and using Shodan.

Check out the following post for deep dive:

Asm0d3us — Favicon hashes