| Guide | GDE-025 |
| Topic | VirusTotal OSINT |
| Domain | Digital infrastructure |
| Last updated | September 2026 |
Short answer: Search a file's SHA-256 hash in VirusTotal before uploading anything, read which engines flagged it, and corroborate with urlscan.io, AbuseIPDB and Hybrid Analysis. A low or zero detection count is read as a clean bill of health far more often than the evidence supports.
What is VirusTotal?
VirusTotal aggregates verdicts from more than 70 antivirus and security engines alongside community votes, passive DNS history and WHOIS data, all queryable through one interface. Owned by Google, it has become the default first stop for checking a suspicious file, link or piece of infrastructure before deciding whether it warrants further investigation.
The workflow pairs naturally with domain and infrastructure investigation: a malicious IP or domain surfaced through VirusTotal becomes a pivot point into related infrastructure via passive DNS, the same expansion technique used in WHOIS and Shodan-based investigations.
| • | Checking whether a suspicious file, attachment or download is known malware |
| • | Assessing whether a URL or domain is linked to phishing or malware distribution |
| • | Pivoting from a malicious IP or domain to related infrastructure via passive DNS |
| • | Corroborating a threat attribution before naming it in a report |
| • | Screening a downloaded tool or script before running it in an investigation |
How do you use VirusTotal for OSINT investigations?
This section covers the tools and sequence for checking indicators and reading the results correctly.
Four tools cover VirusTotal OSINT from a single hash lookup through to full sandbox detonation, free tools first.
VirusTotal: Free web lookup, no login for a single search; free API (500 requests a day, 4 a minute) requires a free account, and the unlimited Premium API is paid. Aggregates 70-plus antivirus engines plus community votes, passive DNS, WHOIS and relationship data for files, URLs, domains and IPs.
urlscan.io: Free, no login for a public scan. Renders the destination page in a sandbox and returns a screenshot, DOM snapshot and the full list of contacted domains and IPs, useful when a link is too new for VirusTotal's engines to have a verdict yet. Public scans are visible to other users; a paid tier adds private scanning.
AbuseIPDB: Free web check, no login required. The API needs a free account and allows 1,000 requests a day. Crowd-sourced abuse reports and a confidence score for a specific IP address, a useful independent cross-check against VirusTotal's own reputation data.
Hybrid Analysis: Free web submissions with a standard account; API access and sample downloads require completing Hybrid Analysis's separate vetting process. CrowdStrike's Falcon Sandbox detonates a file in an isolated environment and reports its actual runtime behaviour, complementing VirusTotal's static, signature-based verdicts with dynamic analysis. CrowdStrike reengineered the platform in late August 2026 (new default QuickScan Pro engine, unified sample view), so expect a different interface to the one in older screenshots.