# mlab.sh INTEL

> Detect domain and IP IOCs on any page and pivot to mlab.sh investigation in one click.Detect domain, IP and crypto wallet IOCs on any page and pivot to a mlab.sh threat intelligence investigation in one click.

Canonical page: [https://chrome-stats.com/d/mlab-sh-intel](https://chrome-stats.com/d/mlab-sh-intel)

## Overview

- **ID:** `mlab-sh-intel`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Removed
- **Publisher:** Alice Sn0w
- **Daily users:** 1
- **Version:** 1.0.0
- **Last updated:** 2026-05-18
- **First published:** 2026-05-15
- **Size:** 158 KB
- **Data as of:** 2026-07-31
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/mlab-sh-intel/)
- **Website:** [https://mlab.sh](https://mlab.sh/)
- **Privacy policy:** [https://addons.mozilla.org/firefox/addon/mlab-sh-intel/privacy/](https://addons.mozilla.org/firefox/addon/mlab-sh-intel/privacy/)

## Description

<strong>Threat intelligence at the speed of your browser.</strong>

<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/31bec775aad810fbb327418d198121bc0b40a4f3f4dac0534eb924790b1c1698/http%3A//mlab.sh" rel="nofollow">mlab.sh</a> INTEL turns every page into a launch pad for security investigation. Read a threat report, a vulnerability advisory, a darkweb dump or a phishing email? See indicators of compromise instantly, scan them in one click, and pivot to a full <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/31bec775aad810fbb327418d198121bc0b40a4f3f4dac0534eb924790b1c1698/http%3A//mlab.sh" rel="nofollow">mlab.sh</a> report — without leaving the page.

<strong>What it does</strong>

• <strong>Detects automatically</strong> on every page you read: domains, IPv4, IPv6 addresses and (opt-in) crypto wallet addresses across Bitcoin, Ethereum / EVM chains, Tron and Solana.

• <strong>Understands defanged IOCs</strong> like <code>evil[.]com</code>, <code>hxxp://</code>, <code>1.1.1[.]1</code>, <code>user[at]<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/2141eac2eacda036b00afc30fd0a7e6f24e9bddf402cf4393fe5144f468147e8/http%3A//example.com" rel="nofollow">example.com</a></code> — the format used in every serious threat report.

• <strong>One-click investigation</strong> via the toolbar popup, the right-click menu, or by clicking a highlighted IOC directly in the page. Each result links to the full <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/31bec775aad810fbb327418d198121bc0b40a4f3f4dac0534eb924790b1c1698/http%3A//mlab.sh" rel="nofollow">mlab.sh</a> report.

• <strong>Inline highlighting</strong> (off by default) colours IOCs with the verdict returned by <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/31bec775aad810fbb327418d198121bc0b40a4f3f4dac0534eb924790b1c1698/http%3A//mlab.sh" rel="nofollow">mlab.sh</a>: clean / suspicious / malicious.

• <strong>History tab</strong> keeps your 10 most recent scans, with filter, copy-to-clipboard and re-scan in one click.

• <strong>Bulk scan</strong> by pasting a list of IOCs into the popup — newline, comma or space separated, refanged automatically.

• <strong>Per-site disable</strong> keeps the extension passive on your bank, intranet or any host you choose.

• <strong>Smart quota management</strong>: 24-hour local cache, server-side cache probe before launching new scans, in-flight deduplication, 60-second back-off when the API is rate-limited.

<strong>Privacy by design</strong>

The extension is built around an aggressive privacy policy:

• No browsing telemetry. The extension only contacts <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/31bec775aad810fbb327418d198121bc0b40a4f3f4dac0534eb924790b1c1698/http%3A//mlab.sh" rel="nofollow">mlab.sh</a> when you explicitly trigger a scan or refresh your quota.
• No third parties — no analytics, no ads, no CDN-loaded scripts.
• Your API key, cache, history and settings stay on your device.
• Works fully <strong>anonymously</strong> by default using <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/31bec775aad810fbb327418d198121bc0b40a4f3f4dac0534eb924790b1c1698/http%3A//mlab.sh" rel="nofollow">mlab.sh</a>'s free Anonymous tier. Add your own API key for higher quota when you need it.

See <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/db4e0f08958a0e488ffea8f67631700dd2ac7151b445438ec1d7818a947f25fe/http%3A//PRIVACY.md" rel="nofollow">PRIVACY.md</a> in the repository for the full disclosure.

<strong>Who is this for?</strong>

SOC analysts, incident responders, threat hunters, security researchers, journalists covering cyber, students, and anyone curious about the indicators they spot online.

## Permissions and access

### Permissions

- `storage`
- `contextMenus`
- `activeTab`
- `tabs`
- `notifications`

### Host permissions

- `https://mlab.sh/*`

### Content script matches

- `<all_urls>`

## Safety

- **Risk impact:** High risk impact
- **Risk likelihood:** High risk likelihood

### Analysis details

- Grants access to browser tabs, which can be used to track user browsing habits and history, presenting a privacy concern.
- This extension is not longer available in the store

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [Hashlight](https://chrome-stats.com/d/hashlight) — 1 users
- [IOC Intel](https://chrome-stats.com/d/ioc-intel) — 1 users
- [🔎 Threat Intel Search](https://chrome-stats.com/d/threat-intel-search) — 3 users
- [Pulsedive Threat Intelligence](https://chrome-stats.com/d/pulsedive) — 34 users, 5.00 / 5
- [Smart IP Lookup](https://chrome-stats.com/d/smart-ip-lookup) — 1 users
- [Zoxrim Security](https://chrome-stats.com/d/zoxrim-security)
- [Threat Intel Analyzer for Carbon Black Cloud](https://chrome-stats.com/d/threat-intel-analyzer-for-cbc) — 3 users
- [SOC Multi-tool](https://chrome-stats.com/d/soc-multi-tool) — 85 users
- [EclecticIQ Threat Scout](https://chrome-stats.com/d/eclecticiq-threat-scout) — 14 users, 5.00 / 5
- [Biniguard-scam-blocker](https://chrome-stats.com/d/biniguard-scam-blocker) — 1 users
- [Visilant](https://chrome-stats.com/d/visilant) — 8 users, 5.00 / 5
- [IOC Checker](https://chrome-stats.com/d/ioc-checker) — 3 users

---

Source: [Chrome-Stats](https://chrome-stats.com/d/mlab-sh-intel)