Infrastructure Reuse By Shared HTTP Body Or Favicon Hash

Tim Peck@timpeck

•updated Nov 17, 2025•3•0•59

Detects when multiple distinct domains, where at least one is known malicious, share the same HTTP body SHA1 hash or favicon MD5 hash. This pattern is indicative of threat actor infrastructure reuse and templating, as described in analysis of campaigns like LaundryBear and FreeDrain.