Anti-malware APIs

AbuseIPDB lets you check whether an IP address has been reported for malicious activity like spam, hacking, or DDoS attacks.

AlienVault Open Threat Exchange (OTX) provides programmatic access to ip/domain/url reputation via REST API.

CAPEsandbox is an open-source malware analysis platform that executes suspicious files in an isolated environment and reports on their behavior.

Google Safe Browsing lets you check any URL against Google's constantly updated lists of phishing sites, malware distributors, and unwanted software.

MalDatabase provides programmatic access to provide malware datasets and threat intelligence feeds via REST API.

MalShare is a free community-driven repository of malware samples that security researchers upload and share for analysis.

MalwareBazaar is a free platform by abuse.ch where security researchers share malware samples along with metadata like file hashes, tags, and threat actor attribution.

Metacert is a link classification and flagging API that checks URLs against curated threat intelligence to identify phishing, adult content, and malicious sites.

NoPhishy (Exerra Phishing Check) checks URLs against a maintained database of known phishing sites and returns whether the link is flagged as a phishing attempt.

Phisherman provides programmatic access to ip/domain/url reputation via REST API.

Scanii is a cloud-based malware scanning API that accepts file uploads and returns a verdict on whether the file contains threats.

URLhaus by abuse.ch is a free, no-auth API for querying a database of URLs that are actively distributing malware.

URLScan.io scans and screenshots any URL in a sandboxed browser, then returns a detailed report covering the page content, network requests, linked domains, technologies detected, and threat indicators.

VirusTotal scans files and URLs against 70+ antivirus engines in one API call.

Web of Trust scores domains and URLs for trustworthiness and safety based on community ratings.