AlienVault Open Threat Exchange (OTX) vs CAPEsandbox

Open Threat Exchange is AT&T Cybersecurity's community threat-intelligence platform, now operated under the LevelBlue brand, where contributors publish "pulses" of malicious IPs, domains, hashes, and URLs that anyone can query. A live, unauthenticated GET against its IPv4 general-info endpoint returned a full 200 JSON response, and both that call and its OPTIONS preflight echoed the request's Origin in Access-Control-Allow-Origin, resolving cors to yes; an OTX-API-KEY is still needed for higher rate limits and pulse subscriptions. Signup, the API key, and the community feed itself are all free.

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.