CAPEsandbox vs MalDatabase

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.

MalDatabase distributes daily-refreshed malware datasets and threat-intelligence feeds — file hashes, behavioral sandbox data, and contacted-domain lists — for use in research and machine-learning training sets. A live call to its real download host, api.maldatabase.com/download, with an Authorization header returned a plain-text 400 error rather than a CORS-enabled response, reconfirming API-key auth over HTTPS and resolving cors to no. Its published plans run from a free 50-samples/day researcher tier up to a $49.99/month Unlimited plan covering 2,000–2,500 samples/day.