Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
49
Categories
9
Tags
142
Latest
July 10, 2026
#osint
Newest first
Threat Intelligence
Passive DNS for Investigators: Tracking Infrastructure Through Time
Attackers rotate infrastructure constantly, but DNS remembers. How passive DNS is collected, how it exposes campaigns, and how to pivot from one domain to an entire operation.
6 min
Threat Intelligence
WHOIS Is Dead, Long Live WHOIS: Investigating Domains After GDPR
GDPR redacted the registrant fields investigators relied on for decades. Domain attribution still works, but the pivots have moved: RDAP, name servers, certificates, and history.
6 min
Engineering
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note