VirusTotal

Overview

VirusTotal aggregates 70+ antivirus engines to analyze files, URLs, domains, and IPs — one API key gives you the same reputation data used by security teams worldwide. Free tier for light use (an invalid key returns 401 — verified).

Quick Start

Check a URL’s analysis (replace YOUR_KEY):

curl "https://www.virustotal.com/api/v3/urls" \
  -H "x-apikey: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

Get an analysis report by ID:

curl "https://www.virustotal.com/api/v3/analyses/ANALYSIS_ID" \
  -H "x-apikey: YOUR_KEY"

Search for a domain/IP report:

curl "https://www.virustotal.com/api/v3/domains/example.com" \
  -H "x-apikey: YOUR_KEY"
curl "https://www.virustotal.com/api/v3/ip_addresses/8.8.8.8" \
  -H "x-apikey: YOUR_KEY"

Authentication

• Register at virustotal.com → free API key (in your account settings).
• Send it as the x-apikey header (an invalid key returns 401 — verified).

Rate Limits & Notes

• Free tier: 500 requests/day (4 requests/minute) — modest; paid tiers scale.
• The v3 API is the current version; v2 is deprecated.
• Submitting a file requires multipart upload to /api/v3/files; URLs are analyzed via the /urls endpoint.
• Reports show per-engine results: category (malicious/suspicious/clean) and result (detection name).

FAQ

Is VirusTotal free? Free tier: 500 requests/day; heavier use is paid.

How do I get a key? Register at virustotal.com — the API key is in your account settings.

Can I check IPs and domains? Yes — /api/v3/ip_addresses/{ip} and /api/v3/domains/{domain}.