CAPEsandbox vs NoPhishy

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.

NoPhishy (listed on RapidAPI as Exerra Phishing Check) queries a maintained database of 299,000+ known phishing domains, refreshed roughly every two hours, to flag whether a submitted URL or domain is a known phishing attempt. A live GET through the real RapidAPI gateway host with an invalid x-rapidapi-key returned a 403 rejection rather than a network-level block, reconfirming API-key auth over HTTPS, and Access-Control-Allow-Origin echoed the request's Origin on that same call. Like other RapidAPI-distributed APIs it offers a free Basic plan alongside paid tiers for higher request volumes.