Browser Extension

mlab.sh INTEL is a browser extension that detects domain and IP indicators of compromise (IOCs) on any page and lets you pivot to an mlab.sh investigation in one click. Detection runs locally and for free; API calls fire only on an explicit user action. Source: mlab-sh/nav-ext.

Features

• Passive DOM scan of every page - detects domains, IPv4 and IPv6, including defanged forms (evil[.]com, 1.1.1[.]1, hxxp://).
• Inline highlight of detected IOCs with verdict colors after a scan.
• Context menu "Scan with mlab.sh" on any selected text.
• Popup: scan the current domain, manual input (auto-detects type and refangs), a list of detected IOCs, recent results, and quota remaining.
• 24h cache of results in chrome.storage.local, so re-scanning an IOC fires no network call.

Supported browsers

• Chrome, Chromium, Edge, Brave - load dist/chrome/.
• Firefox - load dist/firefox/manifest.json (separate build).

Install

The extension is loaded unpacked from a local build.

npm install
npm run build        # builds Chrome + Firefox into dist/

First use

On the first scan, the popup prompts for your mlab.sh API key (get it from your mlab.sh account). The key is validated against /limit/domain before being saved to chrome.storage.local.

Typical flow

1. Open a page with IOCs (for example a threat-intel blog post). The toolbar badge shows the count and IOCs are highlighted.
2. Click a highlighted IOC. A scan triggers and the color updates to clean, suspicious, or malicious.
3. Right-click a selected 1.1.1[.]1 and choose "Scan with mlab.sh". It refangs to 1.1.1.1 and scans.
4. Use the popup's manual input with evil[.]com to see the refanged value and detected type, or hit "Scan this domain" for the current tab's hostname.

See also

• Domain intelligence - what a domain scan returns.
• Crypto Address Lookup and other scan modules the extension pivots into.