MalwareBazaar vs Scanii

MalwareBazaar, part of the abuse.ch threat-intel suite, is a community platform for submitting, tagging, and bulk-downloading real malware samples by hash, signature family, or YARA rule via its JSON API. A live POST to the real mb-api.abuse.ch host without an Auth-Key was rejected, and a bogus key returned {"query_status": "unknown_auth_key"}, confirming abuse.ch's mandatory Auth-Key authentication over HTTPS with no Access-Control-Allow-Origin header on either response. Use is free under abuse.ch's fair-use policy, with a separate paid commercial API tier for organizations needing higher volume or an SLA.

Scanii is a REST API that scans uploaded files, images, and text for malware, unsafe imagery, and inappropriate language across more than 100 image formats and 20+ languages, returning findings, checksums, and content metadata as JSON. A live GET and OPTIONS preflight against api.scanii.com/v2.2/files both returned Access-Control-Allow-Origin: *, and the GET's 401 carried a WWW-Authenticate: Basic realm="Scanii API" header, correcting the stored auth from API Key to Basic Auth (the API key is used as the Basic-auth username, its secret as the password) over HTTPS. New accounts start with free trial credits before moving to metered Starter/Plus/Enterprise plans billed per file scanned.