Mitaka: a browser extension that turns a right-click into OSINT lookups

The extension's job starts with refanging, not searching

Mitaka is a browser extension that makes OSINT search and scan easier, and the README puts the two headline features in a deliberate order. The first is auto IoC selection with refanging, with examples: example[.]com becomes example.com, test[at]example.com becomes [email protected], and hxxp://example.com becomes http://example.com. That ordering matters. Analysts paste indicators out of threat reports, and those reports routinely defang them so that a URL does not turn clickable in a reader's mail client or chat. The tool reverses that convention so the value you selected is the value you can query, which is the step that would otherwise be done by hand for every single indicator.

Twelve indicator types, and a fixed format for each

The supported IoC table lists eleven types with an example of each, which is a compact specification of what the extension recognises. ANS covers an autonomous system number such as AS13335. BTC is a Bitcoin address, and ETH an Ethereum address, with a 0x-prefixed value shown. CVE is a vulnerability identifier such as CVE-2018-11776. Domain is a domain name, URL a full URL, and Email an email address. Hash covers MD5, SHA1 and SHA256. IP is an IPv4 address. Two Google-specific identifiers round out the list, GaPubID for a Google AdSense Publisher ID and GaTrackID for a Google Analytics Tracker ID, both of which appear in a set of services further down. Recognising a type is what lets the extension decide which search services to offer for a given selection.

Sixty-five services, each filtered by the types it accepts

The search engine table is the substance of the tool, and every row states which indicator types that service can be queried with. The list spans very different kinds of service. Reputation and threat intelligence platforms are there, including GreyNoise, which accepts IP, domain, ASN and CVE, OTX, which takes IP, domain, CVE, URL and hash, and Pulsedive, IP, domain, URL and hash. Sandbox and malware sample services appear, such as AnyRun, HybridAnalysis, Intezer, Joe Sandbox, MalwareBazaar, OpenTIP and the Coalition service for CVEs, alongside URL and domain intelligence platforms like crt.sh, DNS Coffee, DNSlytics, Host.io, Robtex, SecurityTrails and Talos. Vulnerability databases appear as cve.org, NVD and Sploitus. The list of 65 plus services in the feature list is consistent with the table.

The type filter is the feature that makes the menu usable

The reason each service row lists its supported types is that the extension shows only the services that can handle what you selected. Pick an IPv4 address and the menu offers the IP-aware services, GreyNoise, Shodan, Censys, AbuseIPDB, IPinfo, ThreatConnect and the rest, and not the CVE databases or the hash sandboxes. Pick a hash and the menu narrows to MalwareBazaar, Intezer, Joe Sandbox, OpenTIP, Pulsedive and HybridAnalysis. Pick a domain and crt.sh, SecurityTrails, Cloudflare Radar and Google Safe Browsing appear. Without that filtering, a fixed list of sixty-five links would be unusable in practice, so the type column is doing the real work of the extension.

Built with WXT, Vue and a schema-validated service list

The repository layout shows a modern extension stack. The root holds a wxt.config.ts, which is the extension framework, a vitest.config.ts for tests, a src/ directory, a tests/ directory, an eslint.config.ts, a tsconfig.json and images/. The package.json shows the dependencies that matter: ioc-extractor at 8.2.0 for the indicator detection itself, neverthrow 8.2.0 for typed error handling, valibot for runtime schema validation, vue 3.5 for the interface, @webext-core/messaging for the background script messaging, and @github/mini-throttle for rate limiting outbound requests. The scripts show a build that runs a type check with vue-tsc alongside the WXT build, separate firefox targets using the MV3 flag, a wxt prepare postinstall step, and linting with both oxlint and eslint, where eslint has a plugin dedicated to neverthrow usage. There is also a daisyUI and Tailwind setup for the interface.

Building it locally uses the same WXT commands the releases use

There is no install script in the README, because the deliverable is a store listing, but the package.json documents the build pipeline, and it is worth reading because it shows what the release artefact is. The build script runs the type check and the WXT build in parallel, the build-only script is the WXT build itself, and the type check is vue-tsc against the project references.

"build:firefox": "run-s build -- --mv3 -b firefox",
"build": "run-p type-check \"build-only {@}\" --",
"build-only": "wxt build",
"type-check": "vue-tsc --build",
"dev": "wxt",
"dev:firefox": "wxt -b firefox"

The Firefox target passes the MV3 flag, which matters because Firefox supports Manifest V3 but on its own schedule, and a developer switching between the two browsers needs the right manifest. The zip scripts produce the store archives, and the dev scripts run WXT in development mode for a browser you can load the unpacked extension into. For an ordinary user, none of this is needed; the Chrome Web Store or Firefox Add-ons listing is the route.

MIT licensed, published to two stores, actively versioned

The licence is MIT, and the extension is published to both the Chrome Web Store and Firefox Add-ons, with the README linking each. The release history shows v2.10.1 on 2026-08-27, v2.10.0 on 2026-08-02 and v2.9.0 on 2026-06-14, so the project ships regularly, and the last push to the repository was on 2026-10-12 with the repository not archived. One detail is worth flagging for anyone building from source. The version field in the root package.json is 0.0.0, which is the conventional placeholder in a WXT monorepo where the real version is stamped at build time, so the artefact users install from the store is not the same version string you will see in the repository. The build badges show a Node.js CI workflow and coverage reporting through Coveralls and a CodeFactor badge.

Editorial conclusion

Mitaka fits an analyst who works with a handful of indicators at a time, copying them out of a report or a chat window and wanting one click to a reputation service, because the refanging step removes the manual un-obfuscation that normally precedes every such lookup. It is a poor fit for pipeline work, since every check opens a browser tab against a third-party service and there is no batch or scripted path described. Verify first which indicator types you actually encounter, since the service list is not uniform, and note that the extension version in the repository is 0.0.0 while the published releases are numbered v2.10.1, so the published artefact is what users actually install.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. ninoseki/mitaka on GitHub
4. README
5. Releases