Google Safe Browsing vs URLScan.io

Google Safe Browsing lets clients check URLs against Google's continuously updated lists of malware, phishing, and unwanted-software sites via the v4 threatMatches:find endpoint, the same data that powers warnings in Chrome and Search. A live POST with a syntactically valid but bogus key returned a 400 "API key not valid" error from safebrowsing.googleapis.com, reconfirming API-key auth and HTTPS, and both that call and its OPTIONS preflight echoed the request Origin in Access-Control-Allow-Origin. The API is free for any Google Cloud project under its published quota.

urlscan.io submits URLs to a real, sandboxed browser and publishes the resulting screenshot, DOM, requested domains, and detected technologies, plus a searchable archive of past scans, all as JSON. A live unauthenticated GET against its search endpoint succeeded immediately (returning IP-scoped X-Rate-Limit headers), and a follow-up OPTIONS preflight returned Access-Control-Allow-Origin: *, resolving cors to yes and confirming HTTPS; submitting new scans instead requires an API-Key header. Public scanning is free within per-minute/hour/day rate limits, with a paid urlscan Pro tier for vetted researchers needing deeper private search.