Discover Real IPs with Fav-up: Shodan‑Powered Favicon Lookup Tool

Fav-up is a powerful IP query tool that leverages Shodan and website favicons to help researchers locate the real IP addresses of target services or devices.

Installation

Ensure Python 3 is installed, then clone the repository and install dependencies:

git clone https://github.com/pielco11/fav-up.git
pip3 install -r requirements.txt

A valid Shodan API key is also required.

Command‑line interface

Provide the API key using one of the following options:

-k / --key : pass the key via stdin

-kf / --key-file : specify a file containing the key

-sc / --shodan-cli : retrieve the key from the Shodan CLI

After configuring the key, the tool can be invoked with various modes:

-f / --favicon-file : local favicon file to query

-fu / --favicon-url : remote favicon URL

-w / --web : target website domain when the favicon URL is unknown

-fh / --favicon-hash : search the entire internet for a favicon hash

-fl / --favicon-list : file listing paths to multiple favicons

-ul / --url-list : file listing URLs of multiple favicons

-wl / --web-list : file listing target domains

-o / --output : specify output file and format (e.g., CSV or JSON)

Usage examples

Favicon file

python3 favUp.py --favicon-file favicon.ico -sc

Favicon URL

python3 favUp.py --favicon-url https://domain.behind.cloudflare/assets/favicon.ico -sc

Web mode

python3 favUp.py --web domain.behind.cloudflare -sc

Using as a Python module

from favUp import FavUp

f = FavUp()
f.shodanCLI = True
f.web = "domain.behind.cloudflare"
f.show = True
f.run()

for result in f.faviconsList:
    print(f"Real-IP: {result['found_ips']}")
    print(f"Hash: {result['favhash']}")

Key attributes

show (bool)

key (string)

keyFile (string)

shodanCLI (bool)

faviconFile (string)

faviconURL (string)

web (string)

shodan (Shodan class)

faviconsList (list[dict])

Project URL

https://github.com/pielco11/fav-up

Screenshots