Skip to main content
Apps built from the same template, forked from the same repository, or cloned by a phishing kit can ship the same favicon. Periphery hashes every favicon it fetches, and the hash is searchable.
A matching favicon means only that the fetched icon bytes produced the same hash. It is a useful pivot, not proof that two apps have the same operator, codebase, or intent.

​
From the console

The favicon sits next to the hostname; hover it to see the hash. On a result row, clicking it adds faviconHash:<hash> to the query you are on, so the other terms still apply; remove them to widen the search. On an app page, clicking it runs the bare faviconHash:<hash> search and shows every app that serves the same icon. You can also paste one or more hashes into the Favicon hash button under the search box. A favicon search shows a note above the results: how many apps serve the favicon, a reminder that the same icon does not mean the same operator, a Hash only link that drops the rest of the query, and a link to run the same hash on Shodan.

​
From a hash you already have

The hash is the favicon hash used by Shodan (http.favicon.hash), Censys, and FOFA: MurmurHash3 with seed 0 over the base64-encoded favicon bytes, read as a signed 32-bit integer. A hash from any of those tools can be pasted into Periphery, and a hash from Periphery can be pivoted back into them.
Comma-separate several hashes to search them together:

​
Reading the results

  • A well-known product icon (a framework default, a SaaS logo) returns many unrelated apps. Combine with domain: or free text to narrow.
  • A company logo on hostnames outside the company’s own domain is worth a look: a forgotten staging deploy, a partner integration, or an impersonation.
  • Apps without a fetched favicon have no hash and never match.