CAPEsandbox vs MalShare

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.

MalShare is a community-run, free public malware sample repository: registered users pull hash lists, per-sample metadata, and the raw binaries themselves through a single api.php endpoint, or upload their own finds back to the pool. A live GET against that endpoint with an invalid key returned a plain-text "user specified in api_key GET variable does not exist" error rather than any CORS header, reconfirming API-key auth over HTTPS and reconfirming cors as no. Standard registered keys are free and capped around 2,000 calls a day, a limit MalShare says it will raise on request.