---
title: Follow the favicon - a short lesson in brand theft
description: Darkbeam can now identify the theft and reuse of a domain’s favicon.
image: https://darkbeam-3424022.hs-sites.com/hubfs/luca-bravo-XJXWbfSo2f0-unsplash.jpg
---

# Follow the favicon - a short lesson in brand theft

---

Impersonation and brand identity theft are the first step of a successful phishing campaign. If a malicious actor can impersonate a domain-based brand with enough rigour to convince an unsuspecting visitor of their validity, they stand a much greater chance of being able to persuade that visitor to hand over their valuable data such as personal or payment details.  

There are a wide range of elements that contribute to an identities brand, but one often under-appreciated element is the humble [favicon](https://en.wikipedia.org/wiki/Favicon) that primarily appears in the tab of your web browser. 

 

![Logo, company name
Description automatically generated with medium confidence](https://darkbeam-3424022.hs-sites.com/hubfs/undefined-May-10-2021-02-22-01-04-PM.png)  

Why are favicons so interesting from a Digital Risk Protection perspective?

Like any other elements of a companies brand, a favicon is a unique and easily identifiable to a viewer. If this is replicated accurately the bad actor stands a greater chance of convincing the viewer that the site is authentic, and therefore tricking them into certain, negative, behaviour.

Let’s take Apple as an example: 

![](https://darkbeam-3424022.hs-sites.com/hubfs/undefined-May-10-2021-02-22-37-10-PM.png)

The immediately recognisable icon reassures the visitor they’ve landed where they expected to. But where else does this favicon appear? Spot the odd one out. 

![Text
Description automatically generated](https://darkbeam-3424022.hs-sites.com/hubfs/undefined-May-10-2021-02-22-53-28-PM.png)

There may be a perfectly good reason why “mhero” are using Apple’s favicon, but it could be that what we see here is the theft of a trademarked brand with the intention of impersonation.  

How can Darkbeam help?

We have created functionality that enables our customers to look for favicon theft and misuse. This is currently available to our API clients and will soon be launched in our SaaS platform. For more information about our favicon functionality please [get in touch](http://darkbeam-3424022.hs-sites.com/contact-us) with a member of the team. 

### Jet White

### Subscribe Here!

## Articles you might enjoy

[View All](http://darkbeam-3424022.hs-sites.com/olddbblog)

<http://darkbeam-3424022.hs-sites.com/olddbblog/identify-and-mitigate-the-threat-of-supplier-lookalike-domains>

### [Identify and mitigate the threat of supplier lookalike domains](http://darkbeam-3424022.hs-sites.com/olddbblog/identify-and-mitigate-the-threat-of-supplier-lookalike-domains)

[**](http://darkbeam-3424022.hs-sites.com/olddbblog/identify-and-mitigate-the-threat-of-supplier-lookalike-domains) ![](https://darkbeam-3424022.hs-sites.com/hs-fs/hubfs/Who%20is%20behind%20cyber%20attacks%20(10).jpg?width=720&name=Who%20is%20behind%20cyber%20attacks%20(10).jpg)

 December 7, 2022

<http://darkbeam-3424022.hs-sites.com/olddbblog/why-how-horizon-users-are-calculating-the-roi-of-third-party-cyber-risk>

### [Why & how Horizon users are calculating the RoI of third-party cyber risk](http://darkbeam-3424022.hs-sites.com/olddbblog/why-how-horizon-users-are-calculating-the-roi-of-third-party-cyber-risk)

[**](http://darkbeam-3424022.hs-sites.com/olddbblog/why-how-horizon-users-are-calculating-the-roi-of-third-party-cyber-risk) ![](https://darkbeam-3424022.hs-sites.com/hs-fs/hubfs/Horizon%20example.png?width=720&name=Horizon%20example.png)

 April 28, 2022

<http://darkbeam-3424022.hs-sites.com/olddbblog/the-importance-of-looking-at-the-horizon>

### [The importance of looking at the horizon](http://darkbeam-3424022.hs-sites.com/olddbblog/the-importance-of-looking-at-the-horizon)

[**](http://darkbeam-3424022.hs-sites.com/olddbblog/the-importance-of-looking-at-the-horizon) ![](https://darkbeam-3424022.hs-sites.com/hs-fs/hubfs/jeremy-lishner-GlKz73GEGWI-unsplash.jpg?width=720&name=jeremy-lishner-GlKz73GEGWI-unsplash.jpg)

 June 1, 2021