IOC & File Intelligence · SOC Platform

Analyze threats.
Decide in seconds.

Mlab.sh is a security investigation platform for SOC analysts and incident responders. Upload files, search IOCs, map findings to MITRE ATT&CK, and coordinate response — all in one place.

Get Started Free

Indicator Types

Free Tools, No Account

RedKit Audit Checks

<5s

Avg. Response Time

( Indicators )

Eleven indicator types, one platform.

Feed any IOC into Mlab and get enriched, correlated intelligence in seconds. Hashes are checked against reputation data and previously seen samples, IPs across passive DNS, domains across RDAP / WHOIS and reputation feeds.

IPv4 & IPv6 lookups

Domain

DNS / WHOIS / reputation

Hash

MD5 / SHA-1 / SHA-256

URL

Phishing & payload detection

File

Static analysis & YARA

Spoofing posture & risk signals

Phone

Number intelligence

MAC

Vendor & OUI lookup

Crypto wallet

18 chains, labels & sanctions

Bash script

Static script review

EML

Header & attachment forensics

Supported file types · up to 10 MB · deleted within 48 h

EXE DLL SYS PDF DOCX XLSX PPTX PNG JPG

( Toolbox )

Modules and free tools, one workflow.

Stop juggling tabs across CyberChef, VT and grep. Scan modules run in parallel and correlate shared hosting, reused certificates, lookalike domains and known actors — and 23 free tools (decoders, parsers, generators and cheat sheets) need no account at all.

TOOL / 01

JS & URL Deobfuscator

Unpack obfuscated JavaScript and malicious URLs from phishing pages and lures.

TOOL / 02

IOC Extractor

Pull IPs, domains, hashes, URLs and emails out of any report or log.

TOOL / 03

YARA Matches

YARA hits on uploaded files — then build and test your own rules on hunt.mlab.sh.

TOOL / 04

MITRE ATT&CK Map

Map and visualize techniques, export as JSON, YARA tags or a list.

TOOL / 05

Passive DNS

Historical IP / domain resolution to spot infrastructure pivots.

TOOL / 06

RDAP & WHOIS

Registration data, registrar and domain age for every lookup.

TOOL / 07

TLS & Cert History

Certificate chain and history, with reused certificates surfaced.

TOOL / 08

EML Parser

Headers, attachments, URLs and SPF / DKIM / DMARC results.

TOOL / 09

Homoglyph Detector

Reveal punycode and lookalike characters behind spoofed domains.

TOOL / 10

XLSX Deep Inspector

Find macros, external connections and hidden sheets in Excel files.

TOOL / 11

Crypto Lookup

Wallet labels, sanctions and risk scoring across 18 chains.

TOOL / 12

CVSS Calculator

CVSS v3.1 and v4.0 base scores, severity and vector strings.

MITRE ATT&CK Mapping

Every finding mapped to a technique.

Mlab automatically classifies behaviors against MITRE ATT&CK tactics and techniques. Compare reports across investigations, spot recurring TTPs, and feed your detection-engineering backlog.

See It Live

( RedKit )

Scan your own attack surface.

Every domain scan comes back as a graded report covering DNS, mail, TLS and exposed surface. RedKit goes further: 44 recon, vulnerability and compliance checks on a domain you have verified, and Redkit IP for the services and versions exposed across your public IP ranges. Findings come back ranked by severity with evidence and remediation guidance, not just a list of ports.

Domain & DNS

Records, DNSSEC, CAA, subdomain takeover candidates and lookalike domains registered against you.

Email posture

SPF, DKIM and DMARC policy strength — including the DMARC set to none that nobody ever enforced.

Web & TLS

Certificate chain, protocol versions, security headers and the HTTP surface as an attacker enumerates it.

A graded verdict

One letter grade and a score out of 100, with findings bucketed high / medium / low / info so triage is obvious.

On a schedule

Watchdog re-runs the same audit every week or every month, and any two runs can be compared — rather than discovering drift at the next audit.

Exportable

Web report, PDF export or JSON over the API. The same findings, in whichever form the reader needs.

API · CLI · MCP

Four ways in. Including your AI agent.

The web app is one interface out of four. Everything is reachable over a REST API with webhooks, from the open-source mlab CLI, and through a native MCP server with 15 tools — so Claude, GPT or any MCP-compatible agent can run real investigations against your tenant. Official n8n nodes, Splunk, Wazuh and Shuffle apps, a GitHub Action and VS Code / JetBrains extensions wire the same data into your stack.

scan_ip start_domain_scan detect_ioc cve_search scan_crypto get_scan_history

Read the Docs

REST API

$ curl -H "Authorization: token $MLAB_KEY" \
    https://mlab.sh/api/v1/scan/ip/45.33.32.156

{
  "ip": "45.33.32.156",
  "as": "AS63949 Akamai Connected Cloud",
  "isp": "Akamai Technologies, Inc.",
  "org": "Linode",
  "country": "United States",
  "region": "California",
  "city": "Fremont",
  "reserved": false,
  "status": "success"
}

The same call works from the CLI and from an MCP client.

( Ecosystem )

One platform, several products.

Mlab.sh is the investigation core. Two self-hosted platforms extend it into response and governance, two hosted products cover risk analysis and source code, and four free intelligence services sit alongside.

Self-hosted platform