# pielco11/fav-up

IP lookup by favicon using Shodan

Repository: https://github.com/pielco11/fav-up
Canonical: https://ross.abutalabs.com/products/fav-up
Language: Python
License: MIT
License Family: permissive
Topics: shodan, shodan-api, lookup-ip, cloudflare, cloudflare-bypass, osint, favicon-icon, murmur3, lookup, phising
Last push: 2025-02-05T05:20:00+00:00

## Health v2 (maintenance only)
Score: 25/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 5, release rhythm 8, longevity 100
- inputs: {"age_days": 2532, "days_push": 574, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1199, forks 148 (observed 2026-08-28T04:03:57.825788+00:00)

## What it is
Fav-up is a Python CLI tool and library that finds the real IP address behind services like Cloudflare by hashing a website's favicon and searching for it via the Shodan API. It supports lookups from local favicon files, favicon URLs, or domain names, and can export results to CSV or JSON.

## Use cases
- find the real IP behind a Cloudflare-protected site
- look up which servers use a given favicon
- identify phishing infrastructure hosting sites
- search Shodan by favicon hash
- deanonymize websites hiding their origin IP
- bulk lookup of favicons from a list of domains

## When to choose
- you have a paid Shodan API key and need to map favicons to IPs
- you're doing OSINT or threat intelligence on websites behind CDNs
- you want a Python module you can integrate into recon workflows

## When to avoid
- you only have a free Shodan account
- the target site has no favicon or a commonly shared one
- you need general-purpose IP geolocation rather than origin discovery

## Facets
- artifact type: cli-tool
- maturity: active
- function: osint, search-engine, cli, developer-tools
- domain: security, osint, networking
- platform: python, cli, cross-platform
- tags: shodan, favicon-lookup, cloudflare-bypass, ip-lookup, murmur3, osint-tool

## Member repositories
- pielco11/fav-up (main) score 25

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:57.825788+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:21:00.625376+00:00, confidence not recorded.
  - readme: https://github.com/pielco11/fav-up (fetched 2026-08-28T04:03:57.825788+00:00, sha ab6f057d5c3d)
- Data as of 2026-08-30T08:39:29.467469+00:00.