VirusTotal
Operator: Google
Security reports and infrastructure relationships for files, hashes, URLs, domains and IP addresses.
Technical Infrastructure
Product
VirusTotal
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
Helps assess suspicious infrastructure and find further technical connections. A detection is an indication; zero detections do not prove that something is safe.
Queries
| Input | Result | Result type |
|---|---|---|
| File hash | Existing file report with security assessments and context. | Retrieved |
| Document / file | Analysis of the submitted file by security services. | Technical check according to provider |
| URL | URL security report and known connections. | Technical check according to provider |
| Domain / website | Security assessments, passive DNS relationships and associated files or URLs; for IP addresses, also available port and service data. | Retrieved |
| IP address | Security assessments, passive DNS relationships and associated files or URLs; for IP addresses, also available port and service data. | Retrieved |
Features
- Analyse files and URLs with multiple security services.
- Retrieve existing reports using MD5, SHA-1 or SHA-256 hashes.
- Investigate domain and IP relationships through passive DNS data and known file or URL connections.
- Use advanced search, sample downloads and hunting through premium offerings.
- Research port, service and fingerprint data from the daily IPv4 scan.
- Query VirusTotal data from AI agents through the REST API or the separate VTAI MCP.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Geographical coverage
Global
Dataset
Aggregated security assessments, submitted files and URLs, the provider's own passive DNS data and data collected daily from the public IPv4 address space.
Access
Requirements
Public web search and analysis. An account is required for community features and to obtain an API key. Premium access is available on request. VTAI has separate token-based access.
Export
JSON through the API; sample downloads and additional data with the appropriate premium access.
Provider
Google
Country of establishment
Unknown
Interfaces
API
Available. Standard REST API v3 with an API key. The free Public API and commercial Premium API have different data and usage rights.
MCP
Available. VTAI is a separate access route through MCP or REST. Free within its allowances; no standard VirusTotal API key is required, as it uses its own bearer token.
AI agents
Available. The official VTAI documentation lists Claude Code and Codex as MCP clients. Hash queries do not upload a file.
Usage note
The free Public API must not be used in commercial products or services, or in business workflows that do not contribute new files.
Legal note
Limitations
- Public queries and uploads may enter the VirusTotal dataset; content may become accessible to the community and premium customers.
- The free Public API is limited to 500 queries per day and four per minute and is subject to commercial-use restrictions.
- Access to more data and advanced search features depends on the access plan; a missing result does not prove that something is safe.
Guides and practical reports
Official · VirusTotal: search reports
VirusTotal · EN
Explains searches for hashes, URLs, IP addresses and domains, and how to handle public queries.