MalwareBazaar vs URLScan.io

MalwareBazaar, part of the abuse.ch threat-intel suite, is a community platform for submitting, tagging, and bulk-downloading real malware samples by hash, signature family, or YARA rule via its JSON API. A live POST to the real mb-api.abuse.ch host without an Auth-Key was rejected, and a bogus key returned {"query_status": "unknown_auth_key"}, confirming abuse.ch's mandatory Auth-Key authentication over HTTPS with no Access-Control-Allow-Origin header on either response. Use is free under abuse.ch's fair-use policy, with a separate paid commercial API tier for organizations needing higher volume or an SLA.

urlscan.io submits URLs to a real, sandboxed browser and publishes the resulting screenshot, DOM, requested domains, and detected technologies, plus a searchable archive of past scans, all as JSON. A live unauthenticated GET against its search endpoint succeeded immediately (returning IP-scoped X-Rate-Limit headers), and a follow-up OPTIONS preflight returned Access-Control-Allow-Origin: *, resolving cors to yes and confirming HTTPS; submitting new scans instead requires an API-Key header. Public scanning is free within per-minute/hour/day rate limits, with a paid urlscan Pro tier for vetted researchers needing deeper private search.