diff --git a/doc/expansion/macaddress_io.json b/doc/expansion/macaddress_io.json
new file mode 100644
index 0000000..6bd2658
--- /dev/null
+++ b/doc/expansion/macaddress_io.json
@@ -0,0 +1,9 @@
+{
+    "description": "MISP hover module for macaddress.io",
+    "logo": "logos/macaddress_io.png",
+    "requirements": ["maclookup: macaddress.io python library", "An access to the macaddress.io API (apikey)"],
+    "input": "MAC address MISP attribute.",
+    "output": "Text containing information on the MAC address fetched from a query on macaddress.io.",
+    "references": ["https://macaddress.io/", "https://github.com/CodeLineFi/maclookup-python"],
+    "features": "This module takes a MAC address attribute as input and queries macaddress.io for additional information.\n\nThis information contains data about:\n- MAC address details\n- Vendor details\n- Block details"
+}
diff --git a/doc/logos/macaddress_io.png b/doc/logos/macaddress_io.png
new file mode 100644
index 0000000..e77f455
Binary files /dev/null and b/doc/logos/macaddress_io.png differ
diff --git a/misp_modules/modules/expansion/__init__.py b/misp_modules/modules/expansion/__init__.py
index 1534fda..daed1ca 100644
--- a/misp_modules/modules/expansion/__init__.py
+++ b/misp_modules/modules/expansion/__init__.py
@@ -1,3 +1,3 @@
 from . import _vmray
 
-__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', 'btc_steroids', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon', 'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl', 'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator', 'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query']
+__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', 'countrycode', 'cve', 'dns', 'btc_steroids', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon', 'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl', 'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator', 'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query', 'macaddress_io']