Investigator Use
VirusTotal is the internet's most widely used multi-engine malware analysis platform, aggregating scanning results from over 70 antivirus engines, URL scanners, and sandbox services. It supports analysis of files, URLs, domains, and IP addresses, and is used daily by security analysts, malware researchers, threat hunters, and OSINT investigators.
What investigators use VirusTotal for: checking whether a file, URL, or IP has been flagged as malicious, researching infrastructure associated with threat actors, pivoting between related indicators of compromise, identifying malware families, and tracking when a domain or IP first appeared in threat feeds.
What data VirusTotal exposes: detection ratios from dozens of antivirus engines, sandbox behavioral reports, passive DNS data showing domains and IPs that resolved to each other historically, WHOIS registration details, SSL certificate chains, file metadata and hashes, and community comments from analysts who have investigated the same indicators.
The graph feature is one of VirusTotal's most powerful OSINT tools. Starting from a file hash, you can pivot to the domain that distributed it, then to other files served from that domain, then to IP addresses the domain resolved to, and then to other domains hosted on those IPs. This technique links together malware campaigns that would otherwise appear unrelated.
For URL and domain investigations: submit a suspicious URL to get a screenshot of the page, HTTP response headers, redirects, and detection verdicts. Domains with a history of malicious activity retain that context even after the malicious content is removed, making VirusTotal useful for assessing whether a domain was previously weaponized.
API access: VirusTotal's public API allows 500 lookups per day with a free account. Intelligence features, retrohunting, and higher API quotas require a premium subscription. Most OSINT investigations can be conducted within the free tier.
In a workflow: use VirusTotal as a first-pass triage tool for any suspicious indicator. If a URL or file is detected, pivot to the related infrastructure graph to identify the broader campaign. Cross-reference findings with Shodan for exposed services and Pulsedive for additional threat intelligence context. Always check the detection timeline — first-seen dates help establish when infrastructure was set up.
Before You Pivot
Record Context
Capture the target, search terms, and why this source is relevant before you leave the page.
Preserve Evidence
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Corroborate
Treat one tool as a lead source. Confirm important findings with independent sources.
Related Tools
CVE
Cyber Threat OSINT
CVE provides standardized vulnerability identifiers and references used in security research, triage, and threat intelligence workflows.
CVE Details
Cyber Threat OSINT
CVE Details aggregates vulnerability records, CVSS scores, and affected software lists for security analysis and patch prioritization.
Default Passwords
Cyber Threat OSINT
Find default passwords and credentials for routers, printers, servers, and network devices for authorized security auditing.
Exploit DB
Cyber Threat OSINT
The Exploit Database archives public exploits and proof-of-concept code for known vulnerabilities, used in penetration testing and research.
Honey DB
Cyber Threat OSINT
HoneyDB aggregates honeypot sensor data to identify malicious IP addresses, attacker tactics, and emerging threat patterns.
Hybrid analysis
Cyber Threat OSINT
Hybrid Analysis provides free malware sandboxing with Falcon Sandbox technology to analyze suspicious files and URLs for threat intelligence.