Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#osint
Newest first
What Your Files Say About You: EXIF and Document Metadata for OSINT and DFIR
Photos carry GPS coordinates and camera serials; Office files and PDFs carry usernames, software versions, edit history and sometimes the text you thought you deleted. What leaks, how to extract it, how stripping works, and where analysts get fooled.
Passive DNS for Investigators: Tracking Infrastructure Through Time
Attackers rotate infrastructure constantly, but DNS remembers. How passive DNS is collected, how it exposes campaigns, and how to pivot from one domain to an entire operation.
WHOIS Is Dead, Long Live WHOIS: Investigating Domains After GDPR
GDPR redacted the registrant fields investigators relied on for decades. Domain attribution still works, but the pivots have moved: RDAP, name servers, certificates, and history.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note