Skip to content
Osint Daily
SponsoredOctoProbe house ad, 300 by 250 pixels, published 16 Oct 2026. Still frame of the square with the OctoProbe wordmark and the line One workspace for the investigation.
Osint Daily cover for ANY.RUN, under Threat intelligence, published 16 Oct 2026. The right side is a monogram because no capture is filed. Interactive malware sandbox with a free account.

01 · Product name

ANY.RUN

Interactive malware sandbox with a free account.

Published by ANYRUN-FZCO.

Free and paidGUIAPIThreat intelligence

In short

ANY.RUN is the interactive malware and phishing sandbox from ANYRUN-FZCO. On 21 Oct 2026 the homepage said you can create an account for free and named a 14-day free trial for a SOC team. Private analyses are tied to Hunter and Enterprise Suite plans. The plans page returned HTTP 200, and its static HTML did not include a dollar amount, so this listing does not print one. The homepage's counters include 16,000 companies and, in another line, 16K companies. A sandbox verdict is a lead.

Website

Product pricing strategy

02

Free and paid

The homepage says create an account for free, and it offers a 14-day free trial for a SOC team. Private analyses are named on Hunter and Enterprise Suite. SSO is named on Enterprise Suite. No dollar figure for those plans was in the static HTML of https://any.run/plans/ on 21 Oct 2026, and this listing does not supply one from memory or from a reseller. Public analyses are the sharing mode the homepage describes outside those paid privacy controls. Threat-intelligence feeds are a separate plans page. Their prices were not in the homepage HTML either. The 16,000 and 16K company lines are counters, not fees. Ask ANY.RUN for a current Hunter or Enterprise quote if the rendered plan table shows dollars this static fetch missed.

Utility and features

03

The homepage at any.run describes an interactive sandbox: upload a file or submit a link, watch the sample, and interact with the virtual machine. It says analyses can be public, or private on Hunter and Enterprise Suite plans. A free account is the start path, and a separate block offers a 14-day free trial for a SOC team. Enterprise Suite is also the plan named for SSO. The company line is ANYRUN-FZCO, Dubai Silicon Oasis, Techno Hub 1, Unit 21, 60th Street, Dubai, UAE, copyright 2026. The page says the service holds SOC 2 Type II.

  • Free account and a 14-day trial. The homepage says create an account for free, and it offers a 14-day free trial for a SOC team.
  • Private mode is a named plan. The homepage says analyses can stay private with Hunter and Enterprise Suite plans.
  • No dollar in the static plans HTML. any.run/plans/ returned HTTP 200. The saved document did not include a dollar price.

Counters on that homepage, quoted as printed, include 16,000 companies, a later 16K companies line, 700K+ database contributors, and 21K samples submitted daily. A 700,000 analysts line also appears. This listing does not average 700K+ contributors and 700,000 analysts into one headcount. Marketing lines about minutes saved and detection rates are the homepage's claims. They are not measurements from this review. The plans URL https://any.run/plans/ returned HTTP 200. The document this client saved was a stylesheet shell and did not contain a dollar sign followed by a price. Threat-intelligence feeds are a second product on the same site, with their own plans URL.

  1. 1

    Start from the free account the homepage names, and treat the 14-day SOC trial as a separate offer.

  2. 2

    Do not quote a Hunter or Enterprise dollar amount until you are looking at a rendered price. The static plans document did not have one.

  3. 3

    Read a verdict as behavior in that sandbox. Corroborate a family name or a controller before you brief it.

Caveats

04

A free account and a 14-day SOC trial are different offers on the same homepage. Private mode is named only with Hunter and Enterprise Suite. Do not describe every free analysis as private.

16,000 companies and 16K companies were both on the homepage. 700K+ database contributors and 700,000 analysts were also both there. Quote the line you mean. Do not average them. A detonation shows what the sample did in ANY.RUN's virtual machine. It does not prove who sent the file, and it does not prove the same behavior on every desktop. This listing did not upload a sample. Interact with a sample only in the sandbox, on a file or URL you are allowed to analyze. The plans page's missing dollar amount is a gap in the static document, not a claim that the product is free beyond the account and the trial the homepage names.

Potential use cases

06

  • The free account and the SOC trial are about to be described as one offer. On 21 Oct 2026 the homepage said create an account for free, and a separate block offered a 14-day free trial for a SOC team. Private analyses are named with Hunter and Enterprise Suite. The static HTML of any.run/plans/ did not include a dollar price.
  • The homepage counters are about to be merged. The page says 16,000 companies and, elsewhere, 16K companies. It also says 700K+ database contributors and 700,000 analysts, plus 21K samples submitted daily. Quote the line you mean. The footer names ANYRUN-FZCO in Dubai Silicon Oasis and says the service holds SOC 2 Type II.
  • A sandbox verdict is about to be briefed as the identity of the sender. The homepage describes behavior inside an interactive virtual machine. That behavior is a lead about the file or URL you were allowed to detonate. It does not name a person. This review did not upload a sample.

Hard cases

The case where the first result is easy to over-read.

A dollar price is filled in from memory

The plans URL returned HTTP 200 and the saved document was a stylesheet shell without a dollar amount. Writing a seat price that was not in that document invents a rate. Say the static page had no dollar figure, and quote the free account and the 14-day trial from the homepage.

Questions

Is ANY.RUN free?

The homepage says you can create an account for free and names a 14-day free trial for a SOC team. Private analyses are on Hunter and Enterprise Suite. The static plans page did not print a dollar price on 21 Oct 2026.

Who publishes ANY.RUN?

The homepage footer says ANYRUN-FZCO, Dubai Silicon Oasis, Techno Hub 1, Unit 21, 60th Street, Dubai, UAE. It also says the service holds SOC 2 Type II.

Citations

07

Titled sources. These public pages are what the quotes on this listing come from.

When this listing changes, the letter says so.

Developments in OSINT. Confirm from your inbox before the first issue.

Only for this letter. Privacy

Related tools

Freemium

VirusTotal

Multi-engine lookups for files, URLs, domains, and IP addresses.

Threat intelligenceGUI
View listing
Freemium

urlscan

Open a URL in a sandbox and keep the screenshot, DOM, and requests.

Threat intelligenceGUI
View listing