virustotal

Analyze hashes, URLs, IPs, and domains for malware risk via VirusTotal APIs.

Updated Aug 23, 2026

Search Tags:#url #malware #domain #hash #threat-intelligence #ip #virustotal

Ready to run

npx skills add https://github.com/cris-m/flopsy --skill virustotal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: virustotal
Source: https://github.com/cris-m/flopsy/tree/main/src/team/templates/skills/virustotal
Command: npx skills add https://github.com/cris-m/flopsy --skill virustotal

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Quickly assess malware risk by querying VirusTotal for files, URLs, IPs, and domains, consolidating threat intelligence into a single workflow.

Core Features & Use Cases

File hash reports: Look up MD5, SHA-1, or SHA-256 hashes to determine known malicious associations.
URL/Domain/IP checks: Inspect URLs, domains, and IP addresses for reputation, phishing, and malware indicators.
Threat intelligence & review: Retrieve rich context such as detections, tags, and related indicators to analyze campaigns.

Quick Start

Check a file or URL against VirusTotal to evaluate safety and risk.

Frequently Asked Questions about virustotal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a URL or IP address for malware and phishing indicators?▼

To scan a URL or IP address for malware, you query the indicator against threat intelligence databases to retrieve malicious counts, reputation checks, and related detection tags.

Can I look up a file hash to check if it is known malware?▼

Yes, you can look up MD5, SHA-1, or SHA-256 file hashes to assess malware risk by checking for known malicious associations and reported detections across threat intelligence sources.

Do I need an API key to check domain reputation and threat intelligence?▼

Yes, checking domain reputation requires access to VirusTotal APIs to query indicators and parse the returned malicious counts, tags, and detections for security investigations.

What is the best way to consolidate threat intelligence for multiple indicators like hashes and domains?▼

The best way to consolidate threat intelligence is to analyze hashes, URLs, IPs, and domains within a single workflow, retrieving rich context such as detections and tags to review malware campaigns.

How does URL scanning work for assessing phishing and malware risk?▼

URL scanning works by inspecting the submitted address against reputation databases to identify phishing and malware indicators, reporting the total malicious detections and associated threat tags.