Unified Search
Paste any indicator into the mlab search bar and get routed to the right intelligence module: IP, domain, hash, URL, email, phone, MAC, crypto address or CVE.
The mlab search bar accepts a single indicator and automatically detects what it is, then routes you to the matching intelligence module. You do not need to pick a scan type first: paste an IP, a domain, a file hash, a URL, an email address, a phone number, a MAC address, a crypto address or a CVE identifier, and mlab sends you to the right page.
1. How search works
Submit an indicator. Enter any value in the search bar, or open https://mlab.sh/search?q={indicator} directly.
Automatic type detection. mlab inspects the value and classifies it into one of the supported indicator types below. Detection is pattern based and runs locally, so it is instant.
Redirect to the module. You are redirected to the dedicated intelligence page for that type, for example /ip/8.8.8.8 or /domain/example.com. If the type cannot be recognised, a "not supported" page is shown instead.
Search is a router, not an endpoint. It does not return data itself: it detects the indicator type and forwards you to the module that analyses it. Each destination module enforces its own scan quota.
2. Supported indicator types
| Indicator | What is detected | You are routed to |
|---|---|---|
| IP address | IPv4 and IPv6 addresses | /ip/{value} |
| CIDR range | Any IPv4 or IPv6 range, e.g. 10.0.0.0/8 | /ip/{value} |
| Domain | Fully qualified domain names | /domain/{value} |
| URL | Values starting with http:// or https:// | /url?q={value} |
| File hash | MD5, SHA-1, SHA-256 and SHA-512 | /hash/{value} |
| Email address | Standard [email protected] format | /email/{value} |
| Phone number | E.164 format, must start with + | /phone/{value} |
| MAC address | Colon or hyphen notation (00:1A:2B:3C:4D:5E) and Cisco dotted (001a.2b3c.4d5e) | /mac/{value} |
| Crypto address | EVM (0x…), Bitcoin, Dogecoin, Tron, Solana and TON addresses | /crypto/{value} |
| CVE | CVE-YYYY-NNNN identifiers | vuln.mlab.sh/cve/{id} |
Phone numbers require the international + prefix. A bare national number such as 0612345678 carries no country code, so mlab cannot know which numbering plan applies and will not guess one.
Detection notes
- MAC before IPv6. A MAC address written with colons looks like six hex groups, so it could be mistaken for an IP. mlab tests the strict MAC pattern first, so
02:42:AC:11:00:02is read as a MAC and a real IPv6 address (eight groups, or a::run) still resolves as an IP. - Crypto addresses are decoded, not pattern matched. Bitcoin, Dogecoin and Tron carry a version byte that names the chain behind a checksum; segwit and taproot carry a bech32 checksum; TON ends in a CRC16; Solana is identified by exclusion. All six families route from the search bar. A malformed address still routes, and the page tells you its checksum does not verify rather than pretending it is unknown.
- EVM addresses cannot be told apart. All 13 EVM chains share one address format, so a
0x…address defaults to Ethereum and the page says so, offering the other chains in one click. See Crypto Lookup. - A CIDR range gets its own page, with network and broadcast address, the usable host window, netmask and wildcard, range size and the reserved block it falls in. It is arithmetic on the address bits, so it costs no quota.
- Anything else. A value that matches none of the patterns above is treated as unrecognised, and the "not supported" page shows the input value and the type mlab tried to detect.
3. Programmatic access
The unified /search route is a web redirector and has no JSON API. Two indicator types can be looked up directly through the REST API, the rest are available on the web modules only.
| Indicator | Web module | REST API |
|---|---|---|
| IP address | /ip/ | GET /api/v1/scan/ip?ip={value} |
| CIDR range | /ip/ | GET /api/v1/scan/ip?ip={value} |
| Crypto address | /crypto/ | GET /api/v1/scan/crypto?address={value}&chain={chain}, or POST for a batch |
| Hash | /hash/ | GET /api/v1/scan/hash?hash={value}, or POST for a batch |
| URL | /url | GET /api/v1/scan/url?url={value} |
| Email address | /email/ | GET /api/v1/scan/email?email={value} |
| Phone number | /phone/ | GET /api/v1/scan/phone?phone={value} |
| MAC address | /mac/ | GET /api/v1/scan/mac?mac={value} |
| Domain | /domain/ | POST /api/v1/scan/domain (full scan, then poll results) |
| CVE | redirect | vuln.mlab.sh has its own API |
See the API Guide for authentication, quotas and response formats.
Only the IP, crypto, domain and file endpoints consume scan quota. Hash, URL, email, phone and MAC lookups are reference-table or DNS reads and cost nothing.
For an EVM address the crypto API cannot derive the chain, because all 13 EVM chains share one address format. Check chain_source in the response: default means Ethereum was assumed. Pass chain whenever you know it, because labels are stored per chain and a wrong guess returns an empty-looking result rather than an error.