Anti-Malware · head-to-head
AlienVault Open Threat Exchange (OTX) vs MalwareBazaar
Open Threat Exchange is AT&T Cybersecurity's community threat-intelligence platform, now operated under the LevelBlue brand, where contributors publish "pulses" of malicious IPs, domains, hashes, and URLs that anyone can query. A live, unauthenticated GET against its IPv4 general-info endpoint returned a full 200 JSON response, and both that call and its OPTIONS preflight echoed the request's Origin in Access-Control-Allow-Origin, resolving cors to yes; an OTX-API-KEY is still needed for higher rate limits and pulse subscriptions. Signup, the API key, and the community feed itself are all free.
MalwareBazaar, part of the abuse.ch threat-intel suite, is a community platform for submitting, tagging, and bulk-downloading real malware samples by hash, signature family, or YARA rule via its JSON API. A live POST to the real mb-api.abuse.ch host without an Auth-Key was rejected, and a bogus key returned {"query_status": "unknown_auth_key"}, confirming abuse.ch's mandatory Auth-Key authentication over HTTPS with no Access-Control-Allow-Origin header on either response. Use is free under abuse.ch's fair-use policy, with a separate paid commercial API tier for organizations needing higher volume or an SLA.
| AlienVault Open Threat Exchange (OTX) | MalwareBazaar | |
|---|---|---|
| Authentication | API Key | API Key |
| Pricing | free | freemium |
| Formats | JSON | JSON |
| CORS | yes | no |
| HTTPS | Yes | Yes |
AlienVault Open Threat Exchange (OTX) supports CORS, while MalwareBazaar doesn't — pick AlienVault Open Threat Exchange (OTX) for direct browser calls.