# Threat.Zone > Hypervisor-level malware sandbox for files and URLs on Windows, Linux, macOS and Android. Run Threat.Zone in the cloud, on-premises or as a private tenant. Threat.Zone is built by Malwation (https://www.malwation.com). Last updated: 2026-09-24. Threat.Zone runs files and URLs in a sandbox on Windows, Linux, macOS and Android and observes them at the hypervisor level, with no agent inside the analysis machine, so evasive malware has less to detect. Around the sandbox it adds static analysis, network traffic capture as PCAP for Wireshark, URL threat analysis, memory and process dump collection and CSI (Crime Scene Investigation), a forensic environment for manual analysis. It runs as a cloud service, on-premises, or as a private tenant (a single-tenant private cloud that Malwation manages). ## Product - [Threat.Zone](https://threat.zone/): Overview of the platform: sandboxing, network insights, in-depth analysis and enterprise deployment. - [Pricing](https://threat.zone/pricing): Free, Researcher, Hunter, Organization (per seat) and Enterprise plans. - [Pricing as Markdown](https://threat.zone/pricing.md): The same plans, prices and feature table in plain text. - [Everything in one file](https://threat.zone/llms-full.txt): This overview, the feature list, the FAQ and the pricing table together. - [About Malwation](https://www.malwation.com/who-we-are): The company that builds Threat.Zone. - [Contact](https://threat.zone/#contact): Sales, Enterprise, on-premises and private tenant questions. - [Privacy policy](https://www.malwation.com/privacy-policy): How Malwation handles personal data, Threat.Zone included. - [Web app](https://app.threat.zone): Sign up and submit a sample. - [API reference](https://app.threat.zone/public-api/docs): Public API documentation. ## Developers - [Threat.Zone Public API docs](https://app.threat.zone/public-api/docs): Every endpoint, with parameters and response shapes. - [Threat.Zone Public API guide](https://app.threat.zone/public-api/guide): Walkthroughs, recipes and the API changelog. - [Threat.Zone Public API reference](https://app.threat.zone/public-api/reference): The same API in an interactive reference. - [Threat.Zone OpenAPI spec](https://app.threat.zone/public-api/docs-json): OpenAPI 3 description of the Public API, JSON (YAML: https://app.threat.zone/public-api/docs-yaml). - Authentication: send `Authorization: Bearer `; create the token on the API Keys page of your Threat.Zone workspace. API and MCP access start with the Organization plan (self-serve at https://app.threat.zone); the Free, Researcher and Hunter plans are web-only. - [Threat.Zone Python SDK](https://pypi.org/project/threatzone/): The official Python client for the Public API (`pip install threatzone`, Python 3.10+); source at https://github.com/Malwation/threatzone-python-sdk. - [Threat.Zone MCP server](https://github.com/Malwation/threatzone-mcp-server): The official MCP server. Hosted over Streamable HTTP at https://app.threat.zone/mcp (`claude mcp add threatzone --transport http https://app.threat.zone/mcp`); 48 API tools plus VNC control of the live sandbox VM. - [API catalog](https://threat.zone/.well-known/api-catalog): RFC 9727 linkset pointing to the spec and docs. ## Deployment options - Cloud: the hosted service at https://app.threat.zone, no setup. - On-premises: installed in your own data center; samples, reports and captures stay inside your network. - Private tenant (private cloud): a fully isolated, single-tenant Threat.Zone cloud on dedicated infrastructure, hosted and managed by Malwation. - Golden image: Enterprise deployments can analyze on your own custom OS images so the sandbox matches your production build. ## URL analysis Submit a URL and Threat.Zone fetches the content behind it; any file it serves is analyzed statically and detonated in the sandbox. The URL and domain are checked against abuse.ch ThreatFox and URLhaus, WHOIS, SSL certificate data and geolocation. - [URL scan announcement](https://www.malwation.com/blog/introducing-our-new-url-scan-feature-in-threat-zone): How URL scan works, from the Malwation blog. ## Features - Hypervisor-level, agentless malware sandbox with Windows 7, 10 and 11, Linux, macOS and Android guests - Static scan - CDR (Content Disarm and Reconstruction) - Syscall monitoring - PCAP capture for Wireshark - Custom VPN and proxy routing (WireGuard, OpenVPN) - URL scan and threat analysis with abuse.ch ThreatFox and URLhaus, WHOIS, SSL and geolocation lookups - Memory and process dump collection - CSI forensic environment (Radare2, Rekall, YARA, fq) - Custom YARA rules - SMTP, ICAP, SMB, EDR, XDR and SOAR integrations - Cloud, on-premises and private tenant deployment - Custom golden images ## Frequently asked questions ### Is Threat.Zone a malware sandbox? Yes. Threat.Zone is an online malware analysis sandbox: it runs a suspicious file or URL inside an isolated virtual machine and records what it does, from process and syscall activity to network traffic. The sandbox is hypervisor-level, so observation happens outside the guest OS, and it is combined with static scanning, CDR, dump collection and a forensic environment in one platform. ### What is hypervisor-based analysis? Hypervisor-based analysis involves running malware samples in an isolated virtual environment at the hypervisor level, allowing safe, accurate, and detailed observation without compromising your real systems. ### Is Threat.Zone agentless? Yes, Threat.Zone is agentless on Windows systems. All analyses occur at the hypervisor level, making it almost impossible for malware to detect the analysis environment. This enhances the accuracy and effectiveness of Threat.Zone’s malware detection compared to traditional solutions. ### Which operating systems can Threat.Zone analyze malware on? Threat.Zone runs samples on Windows 7, Windows 10, Windows 11, Linux, macOS and Android. Windows analysis is agentless, observed from the hypervisor, and Enterprise customers can supply their own golden images so the sandbox matches their production build. The Free plan includes Windows 7 and Windows 10; paid plans unlock all environments. ### Can I deploy Threat.Zone on-premises? Yes. Threat.Zone is available as a cloud service, as an on-premises installation and as a private tenant. For organizations that need enhanced privacy, security or regulatory compliance, the on-premises deployment keeps every sample, report and network capture inside your own environment, under your control, while running the same hypervisor-level sandbox as the cloud. ### What is the difference between cloud, on-premises and private tenant deployment? Cloud is the hosted Threat.Zone service at app.threat.zone, ready to use with no setup. On-premises installs the platform in your own data center, so samples and reports never leave your network. A private tenant (private cloud) is a fully isolated, single-tenant instance that Malwation hosts and manages for you alone. All three run the same hypervisor-level sandbox. ### Can I analyze a URL with Threat.Zone? Yes. Submit a URL and Threat.Zone fetches the content behind it; any file it serves is analyzed statically and detonated in the sandbox like a direct upload. The URL and domain are also checked against abuse.ch ThreatFox and URLhaus, WHOIS records, SSL certificate data and geolocation, so the report covers both the link’s reputation and the payload’s behavior. ### What file formats does Threat.Zone support for analysis? Threat.Zone supports a wide variety of file formats, including executables (EXE, ELF, DMG), scripts (Python, Shell), documents (PDF, Office documents), archives (ZIP, RAR) and URLs. ### Can I use my own VPN or proxy for analysis? Yes, Threat.Zone supports custom VPN solutions like WireGuard, OpenVPN, and proxies to securely route and control network traffic during malware analysis. ### Does Threat.Zone harden its virtual machines to prevent VM detection by malware? Threat.Zone employs advanced VM hardening techniques to simulate realistic user environments and avoid detection by evasive malware. Our system creates random user files with plausible creation and modification timestamps, aligns system tick counts, and uses legitimate CPU models and hardware identifiers. These measures make it extremely difficult for malware to distinguish the analysis environment from a real user system—ensuring more accurate behavior capture and deeper analysis. ### How does Threat.Zone integrate with SOC tools? Threat.Zone connects to your existing stack through its public API and built-in SMTP, ICAP, SMB, EDR, XDR and SOAR integrations. Mail gateways and proxies can hand suspicious attachments and downloads to the sandbox automatically, and SOAR playbooks can submit samples and pull verdicts, reports and IOCs back for triage. Custom YARA rules run inside every analysis, and Organization and Enterprise plans add MCP support. ### Is there a free plan, and what does Threat.Zone cost? Yes, there is a free plan. Threat.Zone’s Free tier costs $0 and includes Windows 7 and Windows 10 sandboxing, up to 50 submissions a day and files up to 16 MB. Paid plans are Researcher at $250 per month, Hunter at $450 per month, and Organization at $400 per seat per month, with annual discounts. Enterprise pricing is custom and covers dedicated infrastructure, on-premises or private tenant deployment, SSO and custom SLAs. ## Threat.Zone pricing > Plans for Threat.Zone, the hypervisor-based malware analysis platform by Malwation. Prices in US dollars. Snapshot of 2026-09-04; the live page is https://threat.zone/pricing. ### Free Perfect for hobby projects and experiments. - Price: Free ### Researcher Researcher Plan for Individual Researchers. - Price: $250/month billed monthly, $199/month billed annually ### Hunter Hunter Plan for Professional Malware Hunters. - Price: $450/month billed monthly, $399/month billed annually ### Organization Organization Plan for team of malware hunters. - Price: $400/month (per seat) billed monthly, $330/month (per seat) billed annually ### Enterprises Dedicated infrastructure, custom SLAs, and white-glove onboarding. - Price: Custom, quoted per contract - Everything in Hunter, plus: Custom API call volume; MCP Support; Custom golden images & all targets; All file extensions & custom file sizes; Custom network configs (WireGuard, OpenVPN, proxy); Private submissions & full report exports; Dedicated support + SSO; Volume licensing & custom SLAs ### Plan comparison | | Free | Researcher | Hunter | Organization | Enterprises | |---|---|---|---|---|---| | Size | 16 MB | 32 MB | 650 MB | 1 GB | 4 GB | | Extensions | All Extensions | All Extensions | All Extensions | All Extensions | All Extensions | | API Limit | – | – | – | 500 | Custom | | Concurrent Limit | 1 | 1 | 1 | 1 | Custom | | Daily Limit | 50 | 250 | 500 | 500 | Custom | | Re-Analyze Submission | – | Yes | Yes | Yes | Yes | | Additional Files | – | Yes | Yes | Yes | Yes | | Download Sample | – | Yes | Yes | Yes | Yes | | Html Report | – | Yes | Yes | Yes | Yes | | PDF Report | – | – | Yes | Yes | Yes | | STIX 2.1 Report | – | – | Yes | Yes | Yes | | Queue Priority | – | Yes | Yes | Yes | Yes | | Commercial Usage | – | – | Yes | Yes | Yes | | Export Submission | – | Yes | Yes | Yes | Yes | | Private Submission | – | Yes | Yes | Yes | Yes | | Custom VPN | – | – | Yes | Yes | Yes | | Network Configs | – | – | Yes | Yes | Yes | | Start Arguments | – | Yes | Yes | Yes | Yes | | Pre-Script | – | Yes | Yes | Yes | Yes | | Run Command | – | Yes | Yes | Yes | Yes | | Scan Duration Extension | – | – | Yes | Yes | Yes | | MCP Support | – | – | – | Yes | Yes | Sign up: https://app.threat.zone. Enterprise, on-premises and private tenant: https://threat.zone/#contact. ## Optional - [Release notes](https://www.malwation.com/releases): Every Threat.Zone version and what changed. - [Malwation blog](https://www.malwation.com/blog): Malware analysis write-ups from the Malwation research team. - [HookMesh and CDR](https://www.malwation.com/hookmesh): Malwation's file sanitization workflows, which use Threat.Zone for analysis. - [Agentic Threat.Zone](https://agentic.threat.zone/): MCP-based agentic malware analysis.