malware-intel
VirusTotal
The canonical file-by-hash lookup: it aggregates antivirus verdicts and sandbox analyses for billions of files, URLs and domains. Paste a hash or URL into the website for a consolidated report, or use its JSON API with a free key for automated lookups. Archives researchers reach for it to identify a mystery file or check whether a hash matches known malware before handling it.
Why it’s useful & how it works
VirusTotal is the first stop for most hash lookups because it runs your file's checksum against more than 70 antivirus engines simultaneously and shows you every vendor's verdict in one consolidated report. Beyond simple detection flags, you also see sandbox behavioral summaries, community comments and related file clusters. You paste an MD5, SHA-1 or SHA-256 into the search bar on the website and get results instantly; automated lookups can be done through its JSON API using a free API key.
What’s inside
VirusTotal holds over 50 billion files, 6 billion URLs and 4 billion domains. This makes it by far the largest publicly accessible file-by-hash corpus, with new submissions arriving continuously from users and security vendors worldwide.
API access
https://www.virustotal.com/api/v3/files/ <sha256> (header x-apikey)
An API key is required (usually free); see the endpoints above for where to get one.
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Responded HTTP 200 455 ms
- Through a datacenter proxy
- Responded HTTP 200 707 ms
Reachability measured 2026-08-22.
Access
Programmatic API access (a key may be required, see the API tag).