Filescan.io is OPSWAT’s free community malware-triage service, powered by technology from MetaDefender Aether. It accepts supported files and URLs, produces searchable reports, and exposes analysis through a web interface and a rate-limited API.
The service is useful when a sample can be analyzed in a public community. It is not the same product as a private MetaDefender Aether deployment: the community tier has public reports, a smaller upload limit, restricted configuration, limited API capacity, and fewer research and administration features.
This review checks OPSWAT’s current Aether product page, version 3.2.0 documentation, community-versus-commercial comparison, workflow guide, and live Filescan.io API documentation as of August 30, 2026. Top5soft did not upload malware, benchmark processing time, validate detections, or use a commercial Aether instance.
Correction published August 30, 2026: The previous edition claimed hands-on testing, universal 10-to-20-second analysis, automatic archive cracking, 70% time savings, fixed free and paid plans, and private community reports. It also used generated interface images. This edition removes those claims and separates public Filescan.io behavior from commercial MetaDefender Aether capabilities.
What Filescan.io is
Filescan.io is the community-facing instance of OPSWAT’s malware-analysis technology. The official comparison describes its use case as free triage with public reports and limited configurability.
The service can accept supported files and URLs, search existing reports, show verdict and signal context, extract indicators, process embedded content, and expose selected data through an OpenAPI-documented interface. Depending on the content, reports may include static properties, strings, scripts, decoded or extracted objects, URLs, domains, IP addresses, QR or image text, visualizations, and behavioral or emulation signals.
MetaDefender Aether is the commercial product family behind the wider capability set. It adds private reports, larger files, priority, user and access management, configurable analysis, custom YARA, advanced search or threat hunting, SIEM or SOAR integrations, and customer-controlled deployment according to the selected edition.
Do not infer that every Aether marketing feature or performance claim is available in the community instance. The public comparison table is the better source for that boundary.
Public reports and sample privacy
OPSWAT’s current comparison marks Filescan.io Community as having no private reports. Its API exposes public-report search, feeds, and report retrieval. A submission can therefore reveal filenames, strings, screenshots, URLs, indicators, embedded content, and other properties even when the original input is not downloadable by every user.
Some API versions expose an is_private submission option. The documentation defines that flag as preventing other users from downloading the file. That is not the same as making the report private. Newer commercial API documentation also has a separate private-report control, but the community comparison says private reports are not part of Filescan.io Community.
Treat the public report as the main disclosure surface. Do not submit customer files, internal documents, unreleased software, credentials, personal data, proprietary code, or regulated incident artifacts unless the organization has authorization to publish the resulting analysis context.
For confidential work, use a licensed MetaDefender Aether deployment with private reports and an appropriate data-processing agreement, or a customer-controlled sandbox. A public-service account or API key alone does not create that confidentiality boundary.
Start with a SHA-256 reputation lookup
OPSWAT’s recommended API workflow begins by calculating SHA-256 locally and querying reputation before uploading. If an existing result already identifies the exact sample as likely malicious or malicious, the workflow can stop before a new detonation.
This hash-first approach reduces unnecessary uploads and avoids duplicate work. It also gives analysts a chance to review the disclosure policy before file content leaves the device. A hash lookup sends the identifier, not the source file.
Hash matching is exact. Repacking an archive, editing a document, or rebuilding an executable creates a different hash. A missing result means only that the service did not return reputation for that exact identifier; it is not evidence of safety.
After a file is submitted, API clients receive a flow identifier and poll for reports. Production integrations should handle queues, errors, timeouts, unsupported types, quota responses, partial reports, and changing API versions instead of assuming every scan immediately returns one final object.
How Aether analysis differs from a full VM sandbox
OPSWAT positions MetaDefender Aether as an adaptive malware-analysis platform using several layers: reputation, predictive static analysis, adaptive sandboxing, threat scoring, and threat hunting in the commercial product. The technology emphasizes analysis and emulation paths that can expose scripts, document behavior, embedded content, and indicators without relying only on a conventional full operating-system detonation.
This architecture can be efficient for supported content and triage. It does not mean that emulation reproduces every operating-system behavior, driver interaction, hardware dependency, user action, network condition, or anti-analysis check. Malware can behave differently in a real endpoint or another sandbox.
The old article claimed Filescan.io had no process trees, registry context, or behavioral depth. That description was too absolute. Report content depends on the file and analysis layer; the service can generate emulation graphs, signal groups, ATT&CK context, IOCs, and extracted or second-stage objects. It is still different from watching a fully interactive remote desktop.
Use Filescan.io as one evidence source. Escalate uncertain samples to a controlled full-system or interactive sandbox when the investigation depends on operating-system behavior that the community report did not reproduce.
Processing time and performance claims
OPSWAT has published Aether technical material with average processing figures around 20 seconds and production observations around 12 seconds, while explicitly noting that results vary widely with the input mix. Its current product marketing also makes large relative speed claims for selected commercial configurations.
Those are vendor measurements, not a Top5soft benchmark and not a guaranteed Filescan.io completion time. Community users can also encounter upload time, queueing, priority differences, extraction, additional analysis, report generation, and API polling.
The previous article converted the vendor range into a universal 10-to-20-second promise, compared it against invented timings for competitors, and claimed a 70% workflow saving. No test artifacts supported those numbers, so they have been removed.
Teams evaluating throughput should use a representative sample set, record file types and sizes, separate queue and processing time, include failure and retry rates, and test the actual licensed deployment. A median alone can hide slow archives or complex documents; tail latency and capacity under burst load matter in a SOC pipeline.
Files, archives, URLs, and analysis output
The platform supports many executable, document, script, mail, archive, image, and URL workflows. The community comparison lists a 100 MB file limit, while commercial standalone Aether can support much larger inputs. The configured instance and current upload form remain authoritative.
API submissions can include an archive password. This is not proof of automatic password cracking. Analysts must supply an appropriate password or use a documented supported convention. Archives can contain nested and extracted objects that expand far beyond the original upload size, so extraction policy and resource limits matter.
URL analysis can add phishing, redirect, page, downloaded-content, QR-code, and indicator context depending on the workflow. Visiting a public report or interacting with artifacts still requires caution: attacker-controlled URLs and extracted samples remain dangerous.
Reports can consolidate verdicts and signals, but a label is not a probability. Inspect the evidence behind likely-malicious or malicious classifications, determine which layer produced it, and check whether the analyzed content and code path match the file under investigation.
API access, quotas, and automation
Filescan.io publishes an OpenAPI interface for file and URL submission, polling, report search, public reports, reputation, artifacts, and feeds. Requests use an API key where required, and the community service enforces API limits.
OPSWAT’s comparison does not promise unlimited community automation, and current quotas can be account- or route-specific. The old article’s daily scans, concurrency, retention period, report-export plan, and monthly price were not found in current official materials and have been removed.
Before automating submissions, place data classification upstream. A mail or upload connector should reject confidential content that is not approved for public analysis, enforce size and type policy, log consent and source, and avoid embedding API keys in client-side code.
Clients should monitor the current API specification and release notes, because routes and response fields can change. Cache exact-hash reputation where permitted, use backoff for quota responses, cap polling, preserve the flow and report identifiers, and store dangerous artifacts only in an isolated research environment.
Community versus commercial Aether
Filescan.io Community is useful for free public triage. The official table identifies its constraints: public rather than private reports, 100 MB files, API limits, no priority processing, no user management or access-control backend, no custom engine configuration, no custom YARA, and no advanced threat hunting or SIEM or SOAR integration.
Commercial MetaDefender Aether is intended for full malware analysis, alerts, and threat hunting. It can provide private reports, larger file limits, user and access controls, configurable analysis, custom YARA, integrations, and standalone deployment. Embedded Aether editions inside MetaDefender Core or Cloud have another subset of capabilities.
These are separate product and deployment decisions, not a simple “Community $49 per month” upgrade path. OPSWAT directs buyers to sales for current commercial licensing. This review does not invent list prices or promise unlimited scans.
Evaluation should cover privacy, region, retention, throughput, file mix, required layers, hunting, artifact access, authentication, SIEM or SOAR, high availability, support, offline updates, and whether the instance must run on premises or in an air-gapped network.
Strengths and limitations
Documented strengths
- Free community access for public malware-triage use cases.
- SHA-256 reputation lookup before file submission.
- Broad support for files, scripts, documents, archives, mail, images, and URLs.
- Extracted indicators, objects, signals, visualizations, and public report search.
- OpenAPI-documented submission, polling, search, report, and feed workflows.
- Backed by the wider MetaDefender Aether analysis technology.
- Clear commercial paths for private reports and customer-controlled deployment.
Important limitations
- Community reports are public.
- Hiding the input sample from download does not make report content private.
- The community file limit is smaller and API usage is limited.
- Analysis does not reproduce every full operating-system behavior.
- Verdicts and threat scores require evidence-based interpretation.
- Community users lack custom YARA, advanced hunting, priority, and administration controls.
- Vendor performance claims are not guaranteed community completion times.
- Commercial pricing and entitlements require a quote.
Alternatives and complementary tools
The source-verified file scanner guide explains when to use reputation, public sandboxing, private cloud analysis, or local sanitization.
VirusTotal is a broad first hash-reputation lookup. Standard submissions join its sharing ecosystem, while licensed Private Scanning produces a different analysis without partner antivirus verdicts.
Hybrid Analysis provides public Falcon Sandbox reports with static and managed runtime evidence. It should receive only samples authorized for community sharing.
ANY.RUN provides live interaction with a remote analysis machine. That can help trigger dialogs or staged behavior; Community sessions are public.
MetaDefender Cloud combines multiscanning, Deep CDR, DLP, sandboxing, and paid private-processing modes for automated upload pipelines.
Dangerzone locally reconstructs supported documents as PDFs. It does not provide malware-family analysis, but it avoids public cloud submission of the source file.
Verdict
Filescan.io is a useful community triage service for samples that can safely produce a public report. Its hash-first workflow, broad content handling, extracted indicators, emulation-oriented analysis, and API make it a practical additional evidence source.
Privacy is the decisive limit. Community reports are public, and a flag that prevents other users from downloading the original file does not hide filenames, screenshots, strings, indicators, or other report data. Sensitive work needs a commercial Aether deployment with private reports and the correct contract or a different approved sandbox.
Do not repeat vendor speed claims as a guaranteed result. Search SHA-256 first, submit only authorized content, inspect the evidence behind the verdict, and escalate when behavior depends on a complete or interactive operating system.
Best fit: public malware triage, supported script and document analysis, IOC extraction, and limited API-assisted research.
Poor fit: confidential samples, unattended uploads without classification, unlimited production automation, custom threat hunting, or analysis that requires a full interactive endpoint.
Frequently asked questions
Is Filescan.io free?
Yes, the community service provides free public triage with API and configuration limits. Commercial MetaDefender Aether products require separate licensing.
Are Filescan.io reports private?
No. OPSWAT’s current comparison says community reports are public. Preventing other users from downloading the original sample does not make the report private.
How fast is Filescan.io?
OPSWAT publishes fast Aether performance figures, but processing varies with input and deployment. Top5soft did not benchmark the community queue, so this review does not promise a fixed time.
Does Filescan.io automatically crack archives?
The API supports supplying an archive password and the platform can process supported embedded content. That should not be described as universal password cracking.
When should I use commercial MetaDefender Aether?
Evaluate it when private reports, larger files, priority, custom YARA, advanced hunting, integrations, user controls, or on-premises and air-gapped deployment are requirements.
