threat-intel Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th) This SANS Internet Storm Center article details a technique for host reconnaissance using favicon.ico files. The author demonstrates a workflow to identify hosts by extracting the favicon hash value from a website and querying Shodan for matching IP addresses. The process involves scripting to automate the retrieval of… SANS Internet Storm Center · Jun 29, 2026 Low CAreconnaissancefaviconshodan