01 · Product name
VirusTotal
Multi-engine lookups for files, URLs, domains, and IP addresses.
Published by VirusTotal.
In short
VirusTotal aggregates malware scanners and reputation data for a file, URL, domain, or IP address. The website is free with rate limits. The public API is quota-limited; VirusTotal Enterprise and Intelligence are paid. Code Insight adds an AI-written summary for some files. Anything you upload can be shared with scanners and other users.
Product pricing strategy
02
Free and paid
VirusTotal is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
The website lookup is free with rate limits. The public API has a narrow free quota. Hunting, feeds, and higher API limits are paid VirusTotal products.
Utility and features
03
VirusTotal, part of Google’s security portfolio, is the place a hash goes before a theory does. A file hash that is already known comes back with engine verdicts, names, and community context. A URL or domain comes back with categories, relationships, and communicating files. A high detection count is a signal. A zero is not a clean bill of health.
- Lookups. Hash, URL, domain, or IP. You get engine votes, timestamps, and related objects. Search in VT Intelligence is a different, paid capability.
- Uploads. A file that is not already in the corpus can be uploaded for scanning. Assume it will be retained and visible to others. Prefer a hash lookup when the file is sensitive.
- Code Insight. An AI summary of some submitted code or scripts. Read it as a draft explanation. The detection names and behavior reports are the evidence.
The free web UI covers the lookup a person can do by hand. Automation, hunting, and bulk downloads sit behind paid products and a tightly limited public API. Code Insight is the AI-assisted piece: a generated summary of a sample, useful as a reading aid, not as a verdict. Do not upload files you are not allowed to share. Submissions are not a private sandbox.
- 1
Search a hash first. Upload a file only if you are allowed to share it and a hash lookup missed.
- 2
Read more than the detection ratio. Open related domains and the first-seen date.
- 3
Treat Code Insight as a summary. Quote the engines and the relationships in anything formal.
- 4
Use the API only inside its quota and terms. Bulk hunting is an enterprise feature.
Caveats
04
VirusTotal aggregates other people’s scanners and sandboxes. Engines false-positive and false-negative. A hash with no results has simply not been seen there, or not seen yet.
Uploading a file gives it to VirusTotal under their terms, which can mean it is shared with the vendors. Do not upload a confidential document to ‘check it.’ Search the hash you computed locally instead. The public site is not the same quota as the API. Community comments are not a verdict.
Screenshots
05
Potential use cases
06
- You have a file hash from an incident and you have not opened the file. Search VirusTotal for the hash. You get vendor verdicts, names, and community comments, which disagree often. Pivot a malicious hash to MalwareBazaar only if you need the sample in a lab, and do not download it onto a work laptop. A ‘clean’ vote is not a promise. New files have few engines.
- A phish contains a domain. Look up the domain and read the detected URLs and the resolution history, not the single score. Pivot the same URL to urlscan for a screenshot and the requests the page made. A parked domain and a malicious one can share a score pattern. Record the date of the VT result.
- A Shodan or Censys host needs reputation context, not another banner. Search the IP in VirusTotal and read communicating files or resolutions if your plan shows them. The output is historical relationships, which can be a shared host. Do not block a CDN IP because one customer was flagged. The free website and the API have different limits. Confirm them on the site.
Hard cases
The case where the first result is easy to over-read.
One engine says malware and the file is yours
A single vendor flags an internal build or a document with a macro your staff use. Open the detection names. If the other engines are silent and you can reproduce the file from your own source, treat it as a possible false positive and follow VirusTotal’s dispute path, not as an incident. Do not upload the confidential original to get a second opinion. Hash it, search the hash, and keep the build provenance next to the result.
Questions
Is VirusTotal free?
The website lookup is free with rate limits. The public API has a narrow free quota. Hunting, feeds, and higher API limits are paid VirusTotal products.
Are VirusTotal uploads private?
No. Do not upload confidential or personal files. Other users and security vendors can receive samples submitted to the service.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
VirusTotal search
https://www.virustotal.com/gui/home/searchDocumentation
VirusTotal documentation
https://docs.virustotal.com/