CAPEsandbox vs MalwareBazaar

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.

MalwareBazaar, part of the abuse.ch threat-intel suite, is a community platform for submitting, tagging, and bulk-downloading real malware samples by hash, signature family, or YARA rule via its JSON API. A live POST to the real mb-api.abuse.ch host without an Auth-Key was rejected, and a bogus key returned {"query_status": "unknown_auth_key"}, confirming abuse.ch's mandatory Auth-Key authentication over HTTPS with no Access-Control-Allow-Origin header on either response. Use is free under abuse.ch's fair-use policy, with a separate paid commercial API tier for organizations needing higher volume or an SLA.