MAC Address Lookup
Decode a MAC address offline: vendor from the IEEE OUI registry, universal vs local administration, randomization, virtualization and the IPv6 address SLAAC would derive from it.
The MAC lookup decodes an Ethernet hardware address and tells you what it is: who registered it, whether it was burned in by a manufacturer or made up on the spot, whether it belongs to a hypervisor, and what IPv6 address it would generate through stateless autoconfiguration.
Everything on this module is computed locally from the address itself plus the IEEE OUI registry. There is no network call, the address is never contacted, and the lookup does not count against any scan quota.
1. How to look up a MAC address
From the search bar. Paste any MAC address. mlab detects it and routes you to /mac/{address}.
By URL. Open https://mlab.sh/mac/{address} directly.
Colon (00:1A:2B:3C:4D:5E), hyphen (00-1A-2B-3C-4D-5E) and Cisco dotted (001a.2b3c.4d5e) notations are all accepted.
2. What you get
| Field | Meaning |
|---|---|
| Verdict | Headline classification: vendor assigned, randomized or local, virtual interface, unregistered OUI, or a reserved address label |
| Vendor | Organisation registered for the OUI in the IEEE registry. Only resolved for universally administered addresses |
| OUI | The 24-bit Organizationally Unique Identifier (first three octets). Null for locally administered or reserved addresses |
| Cast | Unicast or multicast, from the low bit of the first octet |
| Administration | Universal (burned in by the manufacturer) or local (randomized or hand assigned) |
| Randomized | Whether the address looks randomized, as used by iOS and Android private Wi-Fi |
| Virtualization | Hypervisor or container runtime when the prefix is a known one (VMware, VirtualBox, QEMU/KVM, Xen, Hyper-V, Parallels, Docker and more) |
| Special | Set for reserved or protocol addresses: broadcast, null address, IPv4/IPv6 multicast, IEEE 802.1 and Cisco control |
| Derived IPv6 (EUI-64) | The IPv6 link-local address SLAAC would derive from this MAC (RFC 4291). A pivot you can scan on the IP module |
| Formats | The same address in colon, hyphen, Cisco and bare notations |
A locally administered address has no real vendor. Its first three octets may collide with a registered OUI by chance, so mlab does not resolve a vendor for it rather than report a misleading match.
3. API
This lookup is available through the REST API. See the API Guide for authentication and quotas.
GET /api/v1/scan/mac?mac={address}
curl -H "Authorization: Bearer YOUR_API_KEY" \
"https://mlab.sh/api/v1/scan/mac?mac=00:0C:29:1A:2B:3C"The response carries the same data as the web module:
{
"mac": "00:0C:29:1A:2B:3C",
"verdict": "Virtual interface",
"cast": "Unicast",
"administration": "Universal",
"randomized": false,
"oui": "00:0C:29",
"vendor": "VMware, Inc.",
"virtualization": "VMware",
"special": null,
"eui64_ipv6": "fe80::020c:29ff:fe1a:2b3c",
"formats": {
"colon": "00:0C:29:1A:2B:3C",
"hyphen": "00-0C-29-1A-2B-3C",
"cisco": "000c.291a.2b3c",
"bare": "000C291A2B3C"
}
}oui, vendor, virtualization, eui64_ipv6 and special are null when they do not apply. For a reserved address, special is an object with a label and a description.
Crypto Address Lookup
Look up any blockchain address for labels, sanctions status, risk scoring, and classification across supported chains.
Email Lookup
Analyze an email address and its domain's anti-spoofing posture: mailbox type, aliasing, disposable and role detection, plus SPF, DMARC and DKIM read live or from the last domain scan, and an aggregate risk score.