Skip to main content
Apps built from the same template, forked from the same repository, or cloned by a phishing kit usually ship the same favicon. Periphery hashes every favicon it fetches, and the hash is searchable.

​
From the console

The favicon sits next to the hostname; hover it to see the hash. On a result row, clicking it adds faviconHash:<hash> to the query you are on, so the other terms still apply; remove them to widen the search. On an app page, clicking it runs the bare faviconHash:<hash> search and shows every app that serves the same icon.

​
From a hash you already have

The hash is the favicon hash used by Shodan (http.favicon.hash), Censys, and FOFA: MurmurHash3 with seed 0 over the base64-encoded favicon bytes, read as a signed 32-bit integer. A hash from any of those tools can be pasted into Periphery, and a hash from Periphery can be pivoted back into them.
Comma-separate several hashes to search them together:

​
Reading the results

  • A well-known product icon (a framework default, a SaaS logo) returns many unrelated apps. Combine with domain: or free text to narrow.
  • A company logo on hostnames outside the company’s own domain is worth a look: a forgotten staging deploy, a partner integration, or an impersonation.
  • Apps without a fetched favicon have no hash and never match.