Threat Intel  ·  SOC Platform

Analyze threats.
Decide in seconds.

Mlab.sh is a security investigation platform for SOC analysts and incident responders. Upload files, search IOCs, map findings to MITRE ATT&CK, and coordinate response — all in one place.

Get Started Free
185.32.4.91 malicious IP a3f9...c2e1 sha256 / suspicious login.acme.tk phishing domain invoice.docm macro: VT 31/72 MLAB LIVE SCAN 4 IOCs in queue AVG RESPONSE < 5 seconds
11

Indicator Types

23

Free Tools, No Account

24+

Scan & Analysis Modules

<5s

Avg. Response Time

( Indicators )

Eleven indicator types, one platform.

Feed any IOC into Mlab and get enriched, correlated intelligence in seconds. Hashes are pivoted across sandboxes, IPs across passive DNS, domains across WHOIS and reputation feeds.

IP
IPv4 & IPv6 lookups
Domain
DNS / WHOIS / reputation
Hash
MD5 / SHA-1 / SHA-256
URL
Phishing & payload detection
File
Static analysis & YARA
Email
Address & breach exposure
Phone
Number intelligence
MAC
Vendor & OUI lookup
Crypto wallet
Address & chain tracing
Bash script
Static script review
EML
Header & attachment forensics

Supported file types  ·  up to 10 MB

EXE DLL SYS PDF DOCX XLSX PPTX PNG JPG ZIP EML JS
( Toolbox )

24+ modules, one workflow.

Stop juggling tabs across CyberChef, VT, AnyRun and grep. Every tool is wired into the same investigation graph so pivots happen automatically.

TOOL / 01
JS Deobfuscator
Unpack obfuscated JavaScript from phishing pages and malicious docs.
TOOL / 02
PE / ELF Inspector
Strings, sections, imports and entropy for Windows and Linux binaries.
TOOL / 03
Macro Extractor
Pull VBA macros out of Office documents, surface IOCs and intent.
TOOL / 04
PDF Analyzer
Object tree, embedded JavaScript, URLs and exploit signatures.
TOOL / 05
YARA Runner
Run public and custom YARA rules against uploaded files.
TOOL / 06
Sandbox Pivots
Cross-reference hashes against multiple sandbox verdicts and IOCs.
TOOL / 07
Passive DNS
Historical IP / domain resolution to spot infrastructure pivots.
TOOL / 08
WHOIS & SSL
Registrant, age, certificate chain and SAN clustering.
TOOL / 09
URL Sandbox
Detonate suspect URLs and capture the redirect chain.
TOOL / 10
Email Analyzer
Header forensics, SPF / DKIM / DMARC checks, attachment triage.
TOOL / 11
Decoder Chain
Base64, hex, URL, ROT, XOR — chain decoders without leaving the case.
TOOL / 12
IOC Extractor
Pull IPs, domains, hashes and URLs out of any blob of text or report.
MITRE ATT&CK Mapping

Every finding mapped to a technique.

Mlab automatically classifies behaviors against MITRE ATT&CK tactics and techniques. Compare reports across investigations, spot recurring TTPs, and feed your detection-engineering backlog.

See It Live
ATT&CK MATRIX Coverage on this case INITIAL ACCESS EXECUTION PERSISTENCE C2 T1566 Phishing T1190 Public App T1078 Valid Accts T1059 PowerShell T1204 User Exec T1218 Signed Bin T1547 Boot T1053 Task T1543 Service T1071 T1573 T1090 CASE SUMMARY Phishing → PowerShell → Scheduled Task → HTTPS C2 8 / 12 techniques hit · severity HIGH
( RedKit )

Scan your own attack surface.

RedKit turns a domain into a graded report: 24+ recon, vulnerability and compliance modules covering DNS, mail, TLS and exposed surface. Misconfigurations and exposed services come back with remediation guidance, not just a list of ports.

Domain & DNS

Records, DNSSEC, CAA, subdomain takeover candidates and lookalike domains registered against you.

Email posture

SPF, DKIM and DMARC policy strength — including the DMARC set to none that nobody ever enforced.

Web & TLS

Certificate chain, protocol versions, security headers and the HTTP surface as an attacker enumerates it.

A graded verdict

One letter grade and a score out of 100, with findings bucketed high / medium / low / info so triage is obvious.

On a schedule

Re-run a scan on a cadence and watch the grade move, rather than discovering drift at the next audit.

Exportable

Web report, PDF export or JSON over the API. The same findings, in whichever form the reader needs.

API  ·  CLI  ·  MCP

Four ways in. Including your AI agent.

The web app is one interface out of four. Everything is reachable over a REST API with webhooks, from the CLI, and through a native MCP server — so Claude, GPT or any MCP-compatible agent can run real investigations against your tenant. Official n8n community nodes wire the same calls into your automation.

scan_ip start_domain_scan detect_ioc cve_search scan_crypto get_scan_history
Read the Docs
REST API
$ curl -H "x-api-key: $MLAB_KEY" \
    https://mlab.sh/api/v1/scan/ip/45.33.32.156

{
  "ip": "45.33.32.156",
  "as": "AS63949 Akamai Connected Cloud",
  "isp": "Akamai Technologies, Inc.",
  "org": "Linode",
  "country": "United States",
  "region": "California",
  "city": "Fremont",
  "reserved": false,
  "status": "success"
}

The same call works from the CLI and from an MCP client.

( Ecosystem )

One platform, several products.

Mlab.sh is the investigation core. Two self-hosted platforms extend it into response and governance, and four free intelligence services sit alongside.

Self-hosted platform

Mlab IR

Alerts, cases, incidents and evidence on your own infrastructure — with the DORA, NIS2 and GDPR notification clocks running automatically.

Explore Mlab IR
Self-hosted platform

Mlab TPRM

DORA Pillar IV third-party risk: ICT provider registry, five-dimension scoring, contracts and the 15 EBA ITS templates.

Explore Mlab TPRM
Free

vuln.mlab.sh

Search and explore CVEs with severity scores and affected products.
Free

actors.mlab.sh

Indexed profiles of 500+ documented threat actors, with aliases, origins and motivations.
Free

hunt.mlab.sh

Proactive threat hunting with Sigma and YARA detection rules.
Free

news.mlab.sh

Curated cybersecurity news, threat intelligence briefings and CVE alerts.

Start investigating in the next five minutes.

Free account, EU-hosted, no credit card. Or talk to us about deploying the self-hosted platforms alongside an audit.