CAPEsandbox vs URLScan.io

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.

urlscan.io submits URLs to a real, sandboxed browser and publishes the resulting screenshot, DOM, requested domains, and detected technologies, plus a searchable archive of past scans, all as JSON. A live unauthenticated GET against its search endpoint succeeded immediately (returning IP-scoped X-Rate-Limit headers), and a follow-up OPTIONS preflight returned Access-Control-Allow-Origin: *, resolving cors to yes and confirming HTTPS; submitting new scans instead requires an API-Key header. Public scanning is free within per-minute/hour/day rate limits, with a paid urlscan Pro tier for vetted researchers needing deeper private search.