Docs
Open Lodol
DocumentationIntegrationsAPI

VirusTotal

App · Compliance & Security · 19 actions

Check files, URLs, domains and IP addresses with VirusTotal's seventy-odd antivirus engines and blocklists: get reports and verdicts, scan files and links, trace passive DNS, subdomains and the files that contact a domain or address, see what a file did in VirusTotal's sandboxes, and comment and vote with its security community.

Actions

ActionWhat it does
Add commentPost a comment on a file, URL, domain or IP address for VirusTotal's community to see.
Add voteVote a file, URL, domain or IP address harmless or malicious.
Delete commentDelete one of your own comments.
Get analysisSee where a scan stands, and its verdict once every engine has answered.
Get API quotaSee how many requests the connected VirusTotal account has used today, this hour and this month, and how many it has left, before a run that makes many.
Get DNS resolutionsPassive DNS: the IP addresses a domain has pointed to, or the domains that have pointed to an IP address, newest first, with how many vendors flag each.
Get domain reportLook up a domain: how many security vendors flag it, what they categorise it as, its registrar and age, and its current DNS records.
Get file behaviourSee what a file did when VirusTotal's sandboxes ran it: the MITRE ATT&CK techniques it showed, the domains it looked up, the addresses and URLs it contacted, the processes and commands it ran, and the files and registry keys it changed.
Get file reportLook up a file by its hash: how many of some seventy security vendors flag it and what they call it, its threat label, names, size and type, and when VirusTotal first saw it.
Get IP address reportLook up an IP address: how many security vendors flag it, and who runs it (network, autonomous system and country).
Get URL reportLook up a URL: how many security vendors flag it as phishing or malware, what they categorise it as, its page title and where it ends up after redirects.
List commentsGet what VirusTotal's community wrote about a file, URL, domain or IP address, newest first.
List communicating filesGet the files that contacted a domain or IP address when VirusTotal's sandboxes ran them, with each file's verdict: the quickest way to tell a malware server from an ordinary one.
List subdomainsGet the subdomains VirusTotal has seen under a domain, with each one's verdict.
List votesGet how VirusTotal's community voted on a file, URL, domain or IP address: harmless or malicious, newest first.
RescanHave every engine look again, with today's signatures, at a file, URL, domain or IP address VirusTotal already knows, and wait for the fresh verdict.
Scan fileUpload a file for some seventy antivirus engines to scan, and wait for the verdict.
Scan URLSend a URL for some seventy security vendors to check for phishing and malware, and wait for the verdict.
SearchLook up a file hash, URL, domain or IP address in one step, each with its verdict, or find comments by tag.

Add comment

Post a comment on a file, URL, domain or IP address for VirusTotal's community to see. Words starting with # become its tags.

Inputs

What it isitem_typetextRequired
Whether the item is a file (given by its hash), a URL, a domain or an IP address.One of: file (File (by its hash)), url, domain, ip_address (IP address).
ItemitemtextRequired
The file's MD5, SHA-1 or SHA-256 hash, the URL, the domain or the IP address.
CommenttexttextRequired
What to say. Comments are public, so leave out names, email addresses and anything else personal.

Outputs

comment_idtext
The comment's ID, for Delete comment
itemtext
The item: a file hash, URL, domain or IP address
item_typetext
What the item is: file, url, domain or ip_address
posted_attext
When it was posted (ISO 8601)
tagslist
The #tags in it, without the #
texttext
What it says
Example output
{
  "comment_id": "d-example.com-5f1c0a9e",
  "item": "example.com",
  "item_type": "domain",
  "posted_at": "2026-09-30T09:00:00+00:00",
  "tags": [
    "phishing"
  ],
  "text": "Seen in a phishing email posing as a bank. #phishing"
}

Add vote

Vote a file, URL, domain or IP address harmless or malicious. Voting the same way twice comes back with 'voted' false instead of stopping the run.

Inputs

What it isitem_typetextRequired
Whether the item is a file (given by its hash), a URL, a domain or an IP address.One of: file (File (by its hash)), url, domain, ip_address (IP address).
ItemitemtextRequired
The file's MD5, SHA-1 or SHA-256 hash, the URL, the domain or the IP address.
VoteverdicttextRequired
Whether you think it is harmless or malicious.One of: harmless, malicious.

Outputs

itemtext
The item: a file hash, URL, domain or IP address
item_typetext
What the item is: file, url, domain or ip_address
verdicttext
The vote
votedtrue/false
True when the vote was cast. False when you had already voted it the same way
voted_attext
When (ISO 8601). Empty when not voted
Example output
{
  "item": "example.com",
  "item_type": "domain",
  "verdict": "harmless",
  "voted": true,
  "voted_at": "2026-09-30T09:00:00+00:00"
}

Delete comment

Delete one of your own comments. A comment that is already gone comes back with 'deleted' false instead of stopping the run.

Inputs

Comment IDcomment_idtextRequired
The comment_id Add comment or List comments returned.

Outputs

comment_idtext
The comment
deletedtrue/false
False when there was no such comment to delete
Example output
{
  "comment_id": "d-example.com-5f1c0a9e",
  "deleted": true
}

Get analysis

See where a scan stands, and its verdict once every engine has answered. Use it for a scan that was still running when its step stopped waiting.

Inputs

Analysis IDanalysis_idtextRequired
The analysis_id a scan or rescan step returned.
Seconds to wait for the verdictwait_secondsnumber
How long to wait for a scan still running to finish, up to 300. With 0 the scan is read once, as it stands.From 0 to 300. Default: 0.

Outputs

analysis_idtext
The scan's ID, for Get analysis
analyzed_attext
When the scan started (ISO 8601)
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
finishedtrue/false
True once every engine has answered. Until then the verdict is unknown and Get analysis reads it later
flagged_bylist
The security vendors that flagged it, malicious first
harmlessnumber
How many security vendors say it is harmless
itemtext
The file's SHA-256 or the URL scanned
item_typetext
file or url when the scan says which; empty otherwise
linktext
The scanned item's page on VirusTotal
maliciousnumber
How many security vendors flag it as malicious
statustext
queued, in-progress or completed
suspiciousnumber
How many security vendors flag it as suspicious
undetectednumber
How many security vendors checked it and found nothing
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
Example output
{
  "analysis_id": "NDRkODg2MTJmZWE4YThmMzZkZTgyZTEyNzhhYmIwMmY6MTc5MTE5NjM2NA==",
  "analyzed_at": "2026-09-30T08:12:44+00:00",
  "engine_count": 67,
  "finished": true,
  "flagged_by": [
    {
      "category": "malicious",
      "engine": "BitDefender",
      "result": "EICAR-Test-File (not a virus)"
    },
    {
      "category": "malicious",
      "engine": "Kaspersky",
      "result": "EICAR-Test-File"
    }
  ],
  "harmless": 0,
  "item": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "item_type": "file",
  "link": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "malicious": 62,
  "status": "completed",
  "suspicious": 0,
  "undetected": 5,
  "verdict": "malicious"
}

Get API quota

See how many requests the connected VirusTotal account has used today, this hour and this month, and how many it has left, before a run that makes many.

Inputs

None.

Outputs

daily_limitnumber
Requests allowed a day: 500 on the free API
daily_reset_attext
When the daily allowance resets: the next 00:00 UTC
hourly_limitnumber
Requests allowed an hour
monthly_limitnumber
Requests allowed a month
requests_left_this_monthnumber
Requests left this month
requests_left_todaynumber
Requests left today
requests_this_hournumber
Requests made this hour
requests_this_monthnumber
Requests made this month
requests_todaynumber
Requests made today (UTC)
usertext
The account's user name
Example output
{
  "daily_limit": 500,
  "daily_reset_at": "2026-10-01T00:00:00+00:00",
  "hourly_limit": 240,
  "monthly_limit": 15500,
  "requests_left_this_month": 14020,
  "requests_left_today": 463,
  "requests_this_hour": 12,
  "requests_this_month": 1480,
  "requests_today": 37,
  "user": "lodol-security"
}

Get DNS resolutions

Passive DNS: the IP addresses a domain has pointed to, or the domains that have pointed to an IP address, newest first, with how many vendors flag each.

Inputs

Domain or IP addressdomain_or_iptextRequired
A domain, like example.com, or an IPv4 or IPv6 address.
Maximum resultslimitnumber
How many to get, up to 40.From 1 to 40. Default: 10.
Next pagecursortext
To get the next page, the next_cursor an earlier step returned. Leave it empty for the first page.

Outputs

countnumber
How many came back on this page
has_moretrue/false
True when there are more on later pages
itemtext
The domain or IP address
item_typetext
domain or ip_address
next_cursortext
Give this as Next page to get the page after. Empty on the last page
resolutionslist
The resolutions, newest first
Example output
{
  "count": 1,
  "has_more": false,
  "item": "example.com",
  "item_type": "domain",
  "next_cursor": "",
  "resolutions": [
    {
      "domain": "example.com",
      "domain_malicious": 0,
      "ip_address": "23.215.0.136",
      "ip_address_malicious": 0,
      "resolved_at": "2026-09-28T02:11:40+00:00"
    }
  ]
}

Get domain report

Look up a domain: how many security vendors flag it, what they categorise it as, its registrar and age, and its current DNS records.

Inputs

DomaindomaintextRequired
The domain, like example.com. A URL or email address works too: its domain is looked up.

Outputs

categorieslist
What security vendors say it is, e.g. search engines or phishing
created_attext
When it was registered (ISO 8601)
dns_recordslist
Its DNS records when VirusTotal last looked
domaintext
The domain
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
expires_attext
When its registration runs out (ISO 8601)
flagged_bylist
The security vendors that flagged it, malicious first
foundtrue/false
False when VirusTotal has never seen it. Everything else is then empty and the verdict is unknown
harmlessnumber
How many security vendors say it is harmless
last_analyzed_attext
When it was last scanned (ISO 8601)
linktext
Its page on VirusTotal. Empty when VirusTotal has never seen it
maliciousnumber
How many security vendors flag it as malicious
registrartext
Who it is registered with
reputationnumber
VirusTotal's community score: below 0 leans malicious, above 0 harmless. Empty when unknown
suspiciousnumber
How many security vendors flag it as suspicious
tagslist
VirusTotal's tags for it
undetectednumber
How many security vendors checked it and found nothing
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
votes_harmlessnumber
How many community members voted it harmless
votes_maliciousnumber
How many community members voted it malicious
Example output
{
  "categories": [
    "information technology",
    "reference"
  ],
  "created_at": "1995-08-14T04:00:00+00:00",
  "dns_records": [
    {
      "ttl": 300,
      "type": "A",
      "value": "23.215.0.136"
    },
    {
      "ttl": 300,
      "type": "AAAA",
      "value": "2600:1406:3a00:21::173e:2e65"
    }
  ],
  "domain": "example.com",
  "engine_count": 93,
  "expires_at": "2027-08-13T04:00:00+00:00",
  "flagged_by": [],
  "found": true,
  "harmless": 67,
  "last_analyzed_at": "2026-09-29T11:17:32+00:00",
  "link": "https://www.virustotal.com/gui/domain/example.com",
  "malicious": 0,
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "reputation": 0,
  "suspicious": 0,
  "tags": [],
  "undetected": 26,
  "verdict": "clean",
  "votes_harmless": 5,
  "votes_malicious": 0
}

Get file behaviour

See what a file did when VirusTotal's sandboxes ran it: the MITRE ATT&CK techniques it showed, the domains it looked up, the addresses and URLs it contacted, the processes and commands it ran, and the files and registry keys it changed. VirusTotal lists sandbox data among its premium features, so a free key may be refused.

Inputs

File hashfile_hashtextRequired
The file's MD5, SHA-1 or SHA-256 hash, or a link to its page on VirusTotal.

Outputs

commands_executedlist
Shell commands it ran
dns_lookupslist
Domains it looked up
file_hashtext
The file asked about
files_deletedlist
Files it deleted
files_droppedlist
Files it dropped
files_writtenlist
Files it wrote to
foundtrue/false
False when no sandbox has run the file
http_requestslist
HTTP requests it made
ip_trafficlist
Addresses it contacted
linktext
The file's behaviour page on VirusTotal
mitre_attack_techniqueslist
MITRE ATT&CK techniques seen
mutexes_createdlist
Mutexes it created
processes_createdlist
Processes it started
registry_keys_setlist
Windows registry keys it set
tagslist
Behaviour tags, e.g. DETECT_DEBUG_ENVIRONMENT
verdictslist
What the sandboxes judged it, e.g. MALWARE
Example output
{
  "commands_executed": [
    "cmd.exe /c schtasks /create /tn Updater"
  ],
  "dns_lookups": [
    {
      "hostname": "update.example.net",
      "resolved_ips": [
        "203.0.113.7"
      ]
    }
  ],
  "file_hash": "e7a2b1f0c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c",
  "files_deleted": [],
  "files_dropped": [
    {
      "path": "C:\\Users\\user\\AppData\\Roaming\\updater.dll",
      "sha256": "4752a1781840cbb27557eaf48dd69fee02d4590df4ab63d4243bdf98cab419c9"
    }
  ],
  "files_written": [
    "C:\\Users\\user\\AppData\\Roaming\\updater.dll"
  ],
  "found": true,
  "http_requests": [
    {
      "method": "POST",
      "status_code": 200,
      "url": "http://update.example.net/gate.php"
    }
  ],
  "ip_traffic": [
    {
      "destination_ip": "203.0.113.7",
      "destination_port": 443,
      "protocol": "TCP"
    }
  ],
  "link": "https://www.virustotal.com/gui/file/e7a2b1f0c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c/behavior",
  "mitre_attack_techniques": [
    {
      "description": "Adds itself to a Run key to start with Windows",
      "id": "T1547.001",
      "severity": "high"
    }
  ],
  "mutexes_created": [
    "Global\\UpdaterMutex"
  ],
  "processes_created": [
    "C:\\Users\\user\\AppData\\Local\\Temp\\invoice.exe"
  ],
  "registry_keys_set": [
    {
      "key": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater",
      "value": "C:\\Users\\user\\AppData\\Roaming\\updater.dll"
    }
  ],
  "tags": [
    "DETECT_DEBUG_ENVIRONMENT",
    "PERSISTENCE"
  ],
  "verdicts": [
    "MALWARE"
  ]
}

Get file report

Look up a file by its hash: how many of some seventy security vendors flag it and what they call it, its threat label, names, size and type, and when VirusTotal first saw it. A file VirusTotal has never seen is an answer, not an error: 'found' is false and the verdict unknown.

Inputs

File hashfile_hashtextRequired
The file's MD5, SHA-1 or SHA-256 hash, or a link to its page on VirusTotal.

Outputs

engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
first_submitted_attext
When VirusTotal first saw it (ISO 8601)
flagged_bylist
The security vendors that flagged it, malicious first
foundtrue/false
False when VirusTotal has never seen it. Everything else is then empty and the verdict is unknown
harmlessnumber
How many security vendors say it is harmless
last_analyzed_attext
When it was last scanned (ISO 8601)
last_submitted_attext
When it was last sent to VirusTotal (ISO 8601)
linktext
Its page on VirusTotal. Empty when VirusTotal has never seen it
maliciousnumber
How many security vendors flag it as malicious
md5text
The file's MD5 hash
nametext
The file's most telling name
nameslist
Names it was sent to VirusTotal under
reputationnumber
VirusTotal's community score: below 0 leans malicious, above 0 harmless. Empty when unknown
sha1text
The file's SHA-1 hash
sha256text
The file's SHA-256 hash
sizenumber
Its size in bytes
suspiciousnumber
How many security vendors flag it as suspicious
tagslist
VirusTotal's tags for it
threat_categorieslist
What kind of threat it is, e.g. trojan or ransomware
threat_labeltext
VirusTotal's name for the threat, drawn from the vendors' names, e.g. trojan.emotet/zusy
threat_nameslist
The threat family names vendors use, e.g. emotet
times_submittednumber
How many times it was sent to VirusTotal
typetext
What kind of file it is, e.g. Win32 EXE or PDF
undetectednumber
How many security vendors checked it and found nothing
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
votes_harmlessnumber
How many community members voted it harmless
votes_maliciousnumber
How many community members voted it malicious
Example output
{
  "engine_count": 67,
  "first_submitted_at": "2006-05-22T07:43:56+00:00",
  "flagged_by": [
    {
      "category": "malicious",
      "engine": "BitDefender",
      "result": "EICAR-Test-File (not a virus)"
    },
    {
      "category": "malicious",
      "engine": "Kaspersky",
      "result": "EICAR-Test-File"
    }
  ],
  "found": true,
  "harmless": 0,
  "last_analyzed_at": "2026-09-30T08:12:44+00:00",
  "last_submitted_at": "2026-09-30T08:12:44+00:00",
  "link": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "malicious": 62,
  "md5": "44d88612fea8a8f36de82e1278abb02f",
  "name": "eicar.com",
  "names": [
    "eicar.com",
    "eicar.txt"
  ],
  "reputation": 3000,
  "sha1": "3395856ce81f2b7382dee72602f798b642f14140",
  "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "size": 68,
  "suspicious": 0,
  "tags": [
    "text",
    "attachment",
    "known-distributor"
  ],
  "threat_categories": [
    "virus",
    "trojan"
  ],
  "threat_label": "virus.eicar/test",
  "threat_names": [
    "eicar",
    "test"
  ],
  "times_submitted": 1500000,
  "type": "Text",
  "undetected": 5,
  "verdict": "malicious",
  "votes_harmless": 2800,
  "votes_malicious": 1200
}

Get IP address report

Look up an IP address: how many security vendors flag it, and who runs it (network, autonomous system and country).

Inputs

IP addressip_addresstextRequired
The IPv4 or IPv6 address to look up.

Outputs

as_ownertext
Who runs that autonomous system
asnnumber
The number of the autonomous system it is in
continenttext
Two-letter code of its continent, e.g. NA
countrytext
Two-letter code of the country it is in, e.g. US
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
flagged_bylist
The security vendors that flagged it, malicious first
foundtrue/false
False when VirusTotal has never seen it. Everything else is then empty and the verdict is unknown
harmlessnumber
How many security vendors say it is harmless
ip_addresstext
The address
last_analyzed_attext
When it was last scanned (ISO 8601)
linktext
Its page on VirusTotal. Empty when VirusTotal has never seen it
maliciousnumber
How many security vendors flag it as malicious
networktext
The network it belongs to, e.g. 8.8.8.0/24
regional_internet_registrytext
The registry that assigned it, e.g. ARIN or RIPE NCC
reputationnumber
VirusTotal's community score: below 0 leans malicious, above 0 harmless. Empty when unknown
suspiciousnumber
How many security vendors flag it as suspicious
tagslist
VirusTotal's tags for it
undetectednumber
How many security vendors checked it and found nothing
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
votes_harmlessnumber
How many community members voted it harmless
votes_maliciousnumber
How many community members voted it malicious
Example output
{
  "as_owner": "GOOGLE",
  "asn": 15169,
  "continent": "NA",
  "country": "US",
  "engine_count": 93,
  "flagged_by": [],
  "found": true,
  "harmless": 63,
  "ip_address": "8.8.8.8",
  "last_analyzed_at": "2026-09-29T20:05:08+00:00",
  "link": "https://www.virustotal.com/gui/ip-address/8.8.8.8",
  "malicious": 0,
  "network": "8.8.8.0/24",
  "regional_internet_registry": "ARIN",
  "reputation": 523,
  "suspicious": 0,
  "tags": [],
  "undetected": 30,
  "verdict": "clean",
  "votes_harmless": 220,
  "votes_malicious": 30
}

Get URL report

Look up a URL: how many security vendors flag it as phishing or malware, what they categorise it as, its page title and where it ends up after redirects. A URL VirusTotal has never scanned is an answer, not an error: 'found' is false.

Inputs

URLurltextRequired
The URL to look up, like https://example.com/page, or the url_id a scan or report returned.

Outputs

categorieslist
What security vendors say it is, e.g. search engines or phishing
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
final_urltext
Where the URL ended up after redirects
first_submitted_attext
When VirusTotal first saw it (ISO 8601)
flagged_bylist
The security vendors that flagged it, malicious first
foundtrue/false
False when VirusTotal has never seen it. Everything else is then empty and the verdict is unknown
harmlessnumber
How many security vendors say it is harmless
http_statusnumber
The HTTP status the page answered with
last_analyzed_attext
When it was last scanned (ISO 8601)
linktext
Its page on VirusTotal. Empty when VirusTotal has never seen it
maliciousnumber
How many security vendors flag it as malicious
reputationnumber
VirusTotal's community score: below 0 leans malicious, above 0 harmless. Empty when unknown
suspiciousnumber
How many security vendors flag it as suspicious
tagslist
VirusTotal's tags for it
threat_nameslist
Threats found on the page
times_submittednumber
How many times it was sent to VirusTotal
titletext
The page's title
undetectednumber
How many security vendors checked it and found nothing
urltext
The URL
url_idtext
VirusTotal's ID for the URL
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
votes_harmlessnumber
How many community members voted it harmless
votes_maliciousnumber
How many community members voted it malicious
Example output
{
  "categories": [
    "information technology",
    "reference"
  ],
  "engine_count": 92,
  "final_url": "https://example.com/",
  "first_submitted_at": "2013-03-09T17:49:48+00:00",
  "flagged_by": [],
  "found": true,
  "harmless": 68,
  "http_status": 200,
  "last_analyzed_at": "2026-09-29T21:04:16+00:00",
  "link": "https://www.virustotal.com/gui/url/0f115db062b7c0dd030b16878c99dea5c354b49dc37b38eb8846179c7783e9d7",
  "malicious": 0,
  "reputation": 0,
  "suspicious": 0,
  "tags": [],
  "threat_names": [],
  "times_submitted": 4200,
  "title": "Example Domain",
  "undetected": 24,
  "url": "https://example.com/",
  "url_id": "0f115db062b7c0dd030b16878c99dea5c354b49dc37b38eb8846179c7783e9d7",
  "verdict": "clean",
  "votes_harmless": 3,
  "votes_malicious": 0
}

List comments

Get what VirusTotal's community wrote about a file, URL, domain or IP address, newest first.

Inputs

What it isitem_typetextRequired
Whether the item is a file (given by its hash), a URL, a domain or an IP address.One of: file (File (by its hash)), url, domain, ip_address (IP address).
ItemitemtextRequired
The file's MD5, SHA-1 or SHA-256 hash, the URL, the domain or the IP address.
Maximum resultslimitnumber
How many to get, up to 40.From 1 to 40. Default: 10.
Next pagecursortext
To get the next page, the next_cursor an earlier step returned. Leave it empty for the first page.

Outputs

commentslist
The comments, newest first
countnumber
How many came back on this page
has_moretrue/false
True when there are more on later pages
itemtext
The item: a file hash, URL, domain or IP address
item_typetext
What the item is: file, url, domain or ip_address
next_cursortext
Give this as Next page to get the page after. Empty on the last page
Example output
{
  "comments": [
    {
      "comment_id": "d-example.com-7d3b2e14",
      "posted_at": "2026-09-12T10:21:03+00:00",
      "tags": [
        "benign"
      ],
      "text": "Reserved for documentation by IANA. #benign",
      "votes_abuse": 0,
      "votes_negative": 0,
      "votes_positive": 4
    }
  ],
  "count": 1,
  "has_more": false,
  "item": "example.com",
  "item_type": "domain",
  "next_cursor": ""
}

List communicating files

Get the files that contacted a domain or IP address when VirusTotal's sandboxes ran them, with each file's verdict: the quickest way to tell a malware server from an ordinary one.

Inputs

Domain or IP addressdomain_or_iptextRequired
A domain, like example.com, or an IPv4 or IPv6 address.
Maximum resultslimitnumber
How many to get, up to 40.From 1 to 40. Default: 10.
Next pagecursortext
To get the next page, the next_cursor an earlier step returned. Leave it empty for the first page.

Outputs

countnumber
How many came back on this page
fileslist
The files
has_moretrue/false
True when there are more on later pages
itemtext
The domain or IP address
item_typetext
domain or ip_address
next_cursortext
Give this as Next page to get the page after. Empty on the last page
Example output
{
  "count": 1,
  "files": [
    {
      "link": "https://www.virustotal.com/gui/file/e7a2b1f0c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c",
      "malicious": 54,
      "name": "invoice.exe",
      "sha256": "e7a2b1f0c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c",
      "suspicious": 1,
      "threat_label": "trojan.emotet/zusy",
      "type": "Win32 EXE",
      "verdict": "malicious"
    }
  ],
  "has_more": false,
  "item": "203.0.113.7",
  "item_type": "ip_address",
  "next_cursor": ""
}

List subdomains

Get the subdomains VirusTotal has seen under a domain, with each one's verdict.

Inputs

DomaindomaintextRequired
The domain, like example.com.
Maximum resultslimitnumber
How many to get, up to 40.From 1 to 40. Default: 10.
Next pagecursortext
To get the next page, the next_cursor an earlier step returned. Leave it empty for the first page.

Outputs

countnumber
How many came back on this page
domaintext
The domain
has_moretrue/false
True when there are more on later pages
next_cursortext
Give this as Next page to get the page after. Empty on the last page
subdomainslist
The subdomains
Example output
{
  "count": 1,
  "domain": "example.com",
  "has_more": false,
  "next_cursor": "",
  "subdomains": [
    {
      "domain": "www.example.com",
      "last_analyzed_at": "2026-09-27T16:40:12+00:00",
      "link": "https://www.virustotal.com/gui/domain/www.example.com",
      "malicious": 0,
      "suspicious": 0,
      "verdict": "clean"
    }
  ]
}

List votes

Get how VirusTotal's community voted on a file, URL, domain or IP address: harmless or malicious, newest first.

Inputs

What it isitem_typetextRequired
Whether the item is a file (given by its hash), a URL, a domain or an IP address.One of: file (File (by its hash)), url, domain, ip_address (IP address).
ItemitemtextRequired
The file's MD5, SHA-1 or SHA-256 hash, the URL, the domain or the IP address.
Maximum resultslimitnumber
How many to get, up to 40.From 1 to 40. Default: 10.
Next pagecursortext
To get the next page, the next_cursor an earlier step returned. Leave it empty for the first page.

Outputs

countnumber
How many came back on this page
has_moretrue/false
True when there are more on later pages
itemtext
The item: a file hash, URL, domain or IP address
item_typetext
What the item is: file, url, domain or ip_address
next_cursortext
Give this as Next page to get the page after. Empty on the last page
voteslist
The votes, newest first
Example output
{
  "count": 1,
  "has_more": false,
  "item": "example.com",
  "item_type": "domain",
  "next_cursor": "",
  "votes": [
    {
      "verdict": "harmless",
      "voted_at": "2026-09-12T10:21:03+00:00"
    }
  ]
}

Rescan

Have every engine look again, with today's signatures, at a file, URL, domain or IP address VirusTotal already knows, and wait for the fresh verdict.

Inputs

What it isitem_typetextRequired
Whether the item is a file (given by its hash), a URL, a domain or an IP address.One of: file (File (by its hash)), url, domain, ip_address (IP address).
ItemitemtextRequired
The file's MD5, SHA-1 or SHA-256 hash, the URL, the domain or the IP address.
Seconds to wait for the verdictwait_secondsnumber
How long to wait for every engine to answer, up to 300. A scan usually takes 20 to 60 seconds, and a large file longer. With 0 the scan only starts, and Get analysis reads its verdict later.From 0 to 300. Default: 60.

Outputs

analysis_idtext
The scan's ID, for Get analysis
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
finishedtrue/false
True once every engine has answered. Until then the verdict is unknown and Get analysis reads it later
flagged_bylist
The security vendors that flagged it, malicious first
harmlessnumber
How many security vendors say it is harmless
itemtext
The item: a file hash, URL, domain or IP address
item_typetext
What the item is: file, url, domain or ip_address
linktext
The item's page on VirusTotal
maliciousnumber
How many security vendors flag it as malicious
statustext
queued, in-progress or completed
suspiciousnumber
How many security vendors flag it as suspicious
undetectednumber
How many security vendors checked it and found nothing
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
Example output
{
  "analysis_id": "NDRkODg2MTJmZWE4YThmMzZkZTgyZTEyNzhhYmIwMmY6MTc5MTE5NjM2NA==",
  "engine_count": 67,
  "finished": true,
  "flagged_by": [
    {
      "category": "malicious",
      "engine": "BitDefender",
      "result": "EICAR-Test-File (not a virus)"
    },
    {
      "category": "malicious",
      "engine": "Kaspersky",
      "result": "EICAR-Test-File"
    }
  ],
  "harmless": 0,
  "item": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "item_type": "file",
  "link": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "malicious": 62,
  "status": "completed",
  "suspicious": 0,
  "undetected": 5,
  "verdict": "malicious"
}

Scan file

Upload a file for some seventy antivirus engines to scan, and wait for the verdict. Files up to 650 MB. VirusTotal shares uploaded files with its security community, so don't scan anything confidential.

Inputs

FilefiletextRequired
The file to scan: upload one, pick a file from an earlier step, or paste a link to one.
ZIP passwordzip_passwordtext
For a password-protected ZIP file, its password, so VirusTotal can open it and scan what is inside.
Seconds to wait for the verdictwait_secondsnumber
How long to wait for every engine to answer, up to 300. A scan usually takes 20 to 60 seconds, and a large file longer. With 0 the scan only starts, and Get analysis reads its verdict later.From 0 to 300. Default: 60.

Outputs

analysis_idtext
The scan's ID, for Get analysis
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
file_nametext
The name the file was uploaded under
finishedtrue/false
True once every engine has answered. Until then the verdict is unknown and Get analysis reads it later
flagged_bylist
The security vendors that flagged it, malicious first
harmlessnumber
How many security vendors say it is harmless
linktext
The file's page on VirusTotal
maliciousnumber
How many security vendors flag it as malicious
sha256text
The file's SHA-256 hash, for Get file report
sizenumber
Its size in bytes
statustext
queued, in-progress or completed
suspiciousnumber
How many security vendors flag it as suspicious
undetectednumber
How many security vendors checked it and found nothing
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
Example output
{
  "analysis_id": "NDRkODg2MTJmZWE4YThmMzZkZTgyZTEyNzhhYmIwMmY6MTc5MTE5NjM2NA==",
  "engine_count": 67,
  "file_name": "eicar.com",
  "finished": true,
  "flagged_by": [
    {
      "category": "malicious",
      "engine": "BitDefender",
      "result": "EICAR-Test-File (not a virus)"
    },
    {
      "category": "malicious",
      "engine": "Kaspersky",
      "result": "EICAR-Test-File"
    }
  ],
  "harmless": 0,
  "link": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "malicious": 62,
  "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
  "size": 68,
  "status": "completed",
  "suspicious": 0,
  "undetected": 5,
  "verdict": "malicious"
}

Scan URL

Send a URL for some seventy security vendors to check for phishing and malware, and wait for the verdict. VirusTotal visits the URL and shares what it finds, so don't scan links with private tokens in them.

Inputs

URLurltextRequired
The URL to scan, like https://example.com/page.
Seconds to wait for the verdictwait_secondsnumber
How long to wait for every engine to answer, up to 300. A scan usually takes 20 to 60 seconds, and a large file longer. With 0 the scan only starts, and Get analysis reads its verdict later.From 0 to 300. Default: 60.

Outputs

analysis_idtext
The scan's ID, for Get analysis
engine_countnumber
How many security vendors gave a verdict: the 70 in '5 of 70'
finishedtrue/false
True once every engine has answered. Until then the verdict is unknown and Get analysis reads it later
flagged_bylist
The security vendors that flagged it, malicious first
harmlessnumber
How many security vendors say it is harmless
linktext
The URL's page on VirusTotal
maliciousnumber
How many security vendors flag it as malicious
statustext
queued, in-progress or completed
suspiciousnumber
How many security vendors flag it as suspicious
undetectednumber
How many security vendors checked it and found nothing
urltext
The URL scanned
url_idtext
VirusTotal's ID for the URL, for Get URL report
verdicttext
malicious when at least one security vendor flags it as malicious; suspicious when none does but one flags it as suspicious; clean when vendors checked it and none flagged it; unknown when there is no verdict yet
Example output
{
  "analysis_id": "u-0f115db062b7c0dd030b16878c99dea5c354b49dc37b38eb8846179c7783e9d7-1791196364",
  "engine_count": 92,
  "finished": true,
  "flagged_by": [],
  "harmless": 68,
  "link": "https://www.virustotal.com/gui/url/0f115db062b7c0dd030b16878c99dea5c354b49dc37b38eb8846179c7783e9d7",
  "malicious": 0,
  "status": "completed",
  "suspicious": 0,
  "undetected": 24,
  "url": "https://example.com/",
  "url_id": "0f115db062b7c0dd030b16878c99dea5c354b49dc37b38eb8846179c7783e9d7",
  "verdict": "clean"
}

Look up a file hash, URL, domain or IP address in one step, each with its verdict, or find comments by tag. VirusTotal's free API searches by file hash only; the rest needs a premium key.

Inputs

Search forquerytextRequired
A file hash. With a premium key, also a URL, domain, IP address, or a tag such as phishing to find comments tagged with it.
Maximum resultslimitnumber
How many to get, up to 40.From 1 to 40. Default: 10.
Next pagecursortext
To get the next page, the next_cursor an earlier step returned. Leave it empty for the first page.

Outputs

countnumber
How many came back on this page
has_moretrue/false
True when there are more on later pages
next_cursortext
Give this as Next page to get the page after. Empty on the last page
querytext
What was searched for
resultslist
What was found
Example output
{
  "count": 1,
  "has_more": false,
  "next_cursor": "",
  "query": "example.com",
  "results": [
    {
      "id": "example.com",
      "item_type": "domain",
      "link": "https://www.virustotal.com/gui/domain/example.com",
      "malicious": 0,
      "suspicious": 0,
      "title": "example.com",
      "verdict": "clean"
    }
  ]
}

Vimeo

Previous Page

VNDB

Next Page

On this page

ActionsAdd commentAdd voteDelete commentGet analysisGet API quotaGet DNS resolutionsGet domain reportGet file behaviourGet file reportGet IP address reportGet URL reportList commentsList communicating filesList subdomainsList votesRescanScan fileScan URLSearch