MalDatabase vs MalShare

MalDatabase distributes daily-refreshed malware datasets and threat-intelligence feeds — file hashes, behavioral sandbox data, and contacted-domain lists — for use in research and machine-learning training sets. A live call to its real download host, api.maldatabase.com/download, with an Authorization header returned a plain-text 400 error rather than a CORS-enabled response, reconfirming API-key auth over HTTPS and resolving cors to no. Its published plans run from a free 50-samples/day researcher tier up to a $49.99/month Unlimited plan covering 2,000–2,500 samples/day.

MalShare is a community-run, free public malware sample repository: registered users pull hash lists, per-sample metadata, and the raw binaries themselves through a single api.php endpoint, or upload their own finds back to the pool. A live GET against that endpoint with an invalid key returned a plain-text "user specified in api_key GET variable does not exist" error rather than any CORS header, reconfirming API-key auth over HTTPS and reconfirming cors as no. Standard registered keys are free and capped around 2,000 calls a day, a limit MalShare says it will raise on request.