# VirusTotal

> **You are on:** `https://api.beta.paywithlocus.com/api` | [llms.txt](https://beta.paywithlocus.com/llms.txt)
>
> Locus runs on multiple environments -- make sure every URL you call matches your expected environment.
> | Environment | Landing | API |
> |---|---|---|
> | Production | paywithlocus.com | api.paywithlocus.com |
> | Beta | beta.paywithlocus.com | api.beta.paywithlocus.com |
> | Stage | stage.paywithlocus.com | api.stage.paywithlocus.com |
>
> If the API URL above doesn't match your expected environment, re-fetch this file from the correct domain.

> Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

**Category:** Security | **Website:** [www.virustotal.com](https://www.virustotal.com) | **Docs:** [docs.virustotal.com/reference/](https://docs.virustotal.com/reference/)

## Access Methods

| Method | Base URL | Auth |
|--------|----------|------|
| **MPP (Tempo)** | `https://virustotal.mpp.paywithlocus.com/virustotal/` | HTTP 402 auto-payment |
| **Wrapped API** | `https://api.beta.paywithlocus.com/api/wrapped/virustotal/` | `Authorization: Bearer <LOCUS_API_KEY>` |

**OpenAPI discovery:** `GET https://virustotal.mpp.paywithlocus.com/openapi.json`

## Endpoints

### File Report

Get a file scan report by hash. Returns detection results from 70+ antivirus engines, sandbox analysis, and threat context.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `hash` | string | Yes | SHA-256, SHA-1, or MD5 hash of the file |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/file-report \
  -H "Content-Type: application/json" \
  -d '{"hash":"<string>"}'
```

### URL Report

Get a URL scan report. Returns detection results from 70+ antivirus engines/blocklists and threat context.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `url` | string | Yes | URL to look up (e.g. "https://example.com") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/url-report \
  -H "Content-Type: application/json" \
  -d '{"url":"<string>"}'
```

### Domain Report

Get a domain reputation report. Returns detection results, DNS records, WHOIS data, and threat context.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `domain` | string | Yes | Domain name (e.g. "google.com") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/domain-report \
  -H "Content-Type: application/json" \
  -d '{"domain":"<string>"}'
```

### IP Address Report

Get an IP address reputation report. Returns detection results, ASN info, geolocation, and threat context.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `ip` | string | Yes | IP address (e.g. "8.8.8.8") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/ip-report \
  -H "Content-Type: application/json" \
  -d '{"ip":"<string>"}'
```

### Scan URL

Submit a URL for scanning. Returns an analysis ID that can be checked with the analysis endpoint.

**Estimated cost:** $0.085

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `url` | string | Yes | URL to scan (e.g. "https://suspicious-site.com") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/url-scan \
  -H "Content-Type: application/json" \
  -d '{"url":"<string>"}'
```

### Analysis Status

Check the status and results of a scan analysis. Use the analysis ID returned by url-scan.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `id` | string | Yes | Analysis ID from a scan submission |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/analysis \
  -H "Content-Type: application/json" \
  -d '{"id":"<string>"}'
```

### Search

Search across the VirusTotal dataset for files, URLs, domains, and IPs matching a query.

**Estimated cost:** $0.085

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `query` | string | Yes | Search query (e.g. domain name, hash, or advanced search modifiers) |
| `limit` | number | No | Max results to return (default 10) |
| `descriptors_only` | boolean | No | Return only object IDs and types, not full objects |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/search \
  -H "Content-Type: application/json" \
  -d '{"query":"<string>","limit":"<number>","descriptors_only":"<boolean>"}'
```

### DNS Resolution

Get a DNS resolution record. The ID is the IP address concatenated with the domain (e.g. "8.8.8.8google.com").

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `id` | string | Yes | Resolution ID: IP + domain concatenated (e.g. "8.8.8.8google.com") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/dns-resolution \
  -H "Content-Type: application/json" \
  -d '{"id":"<string>"}'
```

### File Comments

Get community comments on a file by hash.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `hash` | string | Yes | SHA-256, SHA-1, or MD5 hash |
| `limit` | number | No | Max comments to return (default 10) |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/file-comments \
  -H "Content-Type: application/json" \
  -d '{"hash":"<string>","limit":"<number>"}'
```

### Domain Comments

Get community comments on a domain.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `domain` | string | Yes | Domain name |
| `limit` | number | No | Max comments to return (default 10) |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/domain-comments \
  -H "Content-Type: application/json" \
  -d '{"domain":"<string>","limit":"<number>"}'
```

### IP Comments

Get community comments on an IP address.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `ip` | string | Yes | IP address |
| `limit` | number | No | Max comments to return (default 10) |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/ip-comments \
  -H "Content-Type: application/json" \
  -d '{"ip":"<string>","limit":"<number>"}'
```

### Popular Threat Categories

Get the most popular threat categories currently trending on VirusTotal.

**Estimated cost:** $0.055

_No parameters required._

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/popular-threat-categories \
  -H "Content-Type: application/json" \
  -d '{}'
```

### URL Comments

Get community comments on a URL.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `url` | string | Yes | URL to look up comments for |
| `limit` | number | No | Max comments to return (default 10) |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/url-comments \
  -H "Content-Type: application/json" \
  -d '{"url":"<string>","limit":"<number>"}'
```

### File Votes

Get community votes (harmless/malicious) on a file by hash.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `hash` | string | Yes | SHA-256, SHA-1, or MD5 hash |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/file-votes \
  -H "Content-Type: application/json" \
  -d '{"hash":"<string>"}'
```

### URL Votes

Get community votes (harmless/malicious) on a URL.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `url` | string | Yes | URL to look up votes for |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/url-votes \
  -H "Content-Type: application/json" \
  -d '{"url":"<string>"}'
```

### Domain Votes

Get community votes (harmless/malicious) on a domain.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `domain` | string | Yes | Domain name |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/domain-votes \
  -H "Content-Type: application/json" \
  -d '{"domain":"<string>"}'
```

### IP Votes

Get community votes (harmless/malicious) on an IP address.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `ip` | string | Yes | IP address |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/ip-votes \
  -H "Content-Type: application/json" \
  -d '{"ip":"<string>"}'
```

### File Behaviours

Get sandbox dynamic analysis behaviour reports for a file. Includes process activity, network calls, file operations, and registry changes.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `hash` | string | Yes | SHA-256, SHA-1, or MD5 hash |
| `limit` | number | No | Max behaviour reports to return (default 10) |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/file-behaviours \
  -H "Content-Type: application/json" \
  -d '{"hash":"<string>","limit":"<number>"}'
```

### Latest Comments

Get the latest community comments posted across all of VirusTotal.

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | number | No | Max comments to return (default 10) |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/latest-comments \
  -H "Content-Type: application/json" \
  -d '{"limit":"<number>"}'
```

### Attack Tactic

Get details about a MITRE ATT&CK tactic by ID (e.g. "TA0001" for Initial Access).

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `id` | string | Yes | MITRE ATT&CK tactic ID (e.g. "TA0001") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/attack-tactic \
  -H "Content-Type: application/json" \
  -d '{"id":"<string>"}'
```

### Attack Technique

Get details about a MITRE ATT&CK technique by ID (e.g. "T1059" for Command and Scripting Interpreter).

**Estimated cost:** $0.055

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `id` | string | Yes | MITRE ATT&CK technique ID (e.g. "T1059") |

```bash
curl -X POST https://virustotal.mpp.paywithlocus.com/virustotal/attack-technique \
  -H "Content-Type: application/json" \
  -d '{"id":"<string>"}'
```