Разобрался, Яндекс хочет получать JSON.
$params = [
'client' => ['clientId' => 'YaSfBrowsingAPI', 'clientVersion' => '1'],
'threatInfo' => [
'threatTypes' => ['THREAT_TYPE_UNSPECIFIED', 'MALWARE', 'SOCIAL_ENGINEERING', 'UNWANTED_SOFTWARE', 'POTENTIALLY_HARMFUL_APPLICATION'],
'platformTypes' => ['ALL_PLATFORMS'],
'threatEntryTypes' => ['URL'],
'threatEntries' => [['url' => 'http://malware-driveby.test.safebrowsing.yandex']]
]
];
$check = request('POST', 'https://sba.yandex.net/v4/threatMatches:find?key=<TOKEN>', [
'params' => json_encode($params), 'headers' => ['Content-Type: application/json']
])['content'];