EVERYTHING XIAOMI
Get listed

VirusTotal Intelligence

VirusTotal Intelligence is a paid search service for examining files and related threat data in VirusTotal’s dataset.

Place
#17 of 27
Score
5.3

What VirusTotal Intelligence is

VirusTotal Intelligence is a paid search service for examining files and related threat data in VirusTotal’s dataset. Queries can use hashes, antivirus detections, metadata, filenames, structural properties, and file size, with modifiers for files, URLs, domains, and IP addresses. VTGrep provides content search, and file similarity search is also available. Results can be sorted by first seen, last seen, detection ratio, submissions, or size; selected results can be downloaded or copied by hash. Standard tiers provide 90 days for advanced searches, Retrohunt, and VTGrep, while Threat Hunter PRO provides one year. Both allow up to 10K Retrohunt matches per job. Public API search is limited to hash queries; private API supports combined property searches and may include sandbox behavior, integrated-tool data, and goodware signals. Integrations support security workflows, including VT4Splunk for enriching Splunk events. Pricing depends on usage and requires a quote.

Good

  • Searches files, URLs, domains, and IPs
  • VTGrep and similarity search included
  • Up to 10K Retrohunt matches per job
  • Private API supports combined queries
  • Documents Splunk integration

Watch out

  • Pricing requires a usage-based quote
  • Public API search is hash-only
  • Web indicators enter community-accessible datasets
  • Sensitive information should not be submitted

Who it suits

It suits qualified security teams, antivirus partners, and organizations investigating harmful samples or threat indicators. API users can connect searches and enrichment to security workflows.

Verdict

VirusTotal Intelligence offers broad historical searching, content analysis, and API-based threat investigation. Its data-sharing warning and quote-based pricing are important considerations before submitting indicators or planning deployment.

Plans and prices

From VirusTotal Intelligence's own pricing page, checked 9 Oct 2026.

All about pricing
PlanPriceWhat it gives you
Standard tiersPriced on requestAdvanced searches: 90 days · Retrohunt: 90 days, up to 10K matches per job · Content search (VTGrep): 90 days · Pricing depends on usage; contact VirusTotal for a quote.
Threat Hunter PROPriced on requestAdvanced searches: 1 year · Retrohunt: 1 year, up to 10K matches per job · Content search (VTGrep): 1 year · Pricing depends on usage; contact VirusTotal for a quote.

The facts

Each one read from VirusTotal Intelligence's own pages, with the date it was checked.

What it does

API search limit
The maker says public API search is limited to hash queries, while private API supports combined property-based queries.checked 9 Oct 2026
Commercial use
The maker describes the private API as available for commercial or government use and says pricing depends on usage and requires a quote.checked 9 Oct 2026
Integrations
VirusTotal documents third-party integrations for security workflows including alert triage, event enrichment, false-positive discarding, detection, and response.checked 9 Oct 2026
Intended users
The maker describes premium services as tools for qualified customers and antivirus partners to search for and access harmful file samples for further study.checked 9 Oct 2026
Premium data
The private API can include integrated-tool file and URL information, sandbox behavioral data, and goodware signals.checked 9 Oct 2026
Product
VirusTotal Intelligence searches its dataset for files matching criteria such as hashes, antivirus detections, metadata, filenames, structural properties, and file size.checked 9 Oct 2026
Results
Search results can be sorted by first seen, last seen, detection ratio, submissions, or size, and users can copy hashes or download selected results.checked 9 Oct 2026
Retrohunt
The listed Standard tiers allow Retrohunt searches over 90 days and Threat Hunter PRO over one year, with up to 10K matches per job for both.checked 9 Oct 2026
Search scope
Its documentation lists file, URL, domain, and IP search modifiers, content search (VTGrep), and file similarity search.checked 9 Oct 2026
Sensitive indicators
The Intelligence documentation warns that indicators submitted or queried through the web interface are scanned and added to the dataset for community access, and advises against using sensitive, confidential, or personally identifiable information.checked 9 Oct 2026
Splunk
VirusTotal lists VT4Splunk as its official Splunk app for automatically enriching Splunk events with VirusTotal threat intelligence.checked 9 Oct 2026
Support
The maker directs users seeking pricing information to contact VirusTotal with their use case and usage estimates for a quote.checked 9 Oct 2026

Alternatives to VirusTotal Intelligence

All alternatives
  1. 1

    Malwagon

    Free planWebAPILinuxmacOS
    7.7From $79 a month
    Visit
  2. 2ANY.RUN logo

    ANY.RUN

    Free planAndroidiOSWebAPI
    7.5Free plan
    Visit
  3. 3

    CAPE Sandbox

    Free planOpen sourceWebAPILinuxSelf-hosted
    7.4Free plan
    Visit
  4. 4Detonate logo

    Detonate

    Free planWebAPILinuxSelf-hosted
    7.3From $4,990 a year
    Visit
  5. 5

    CrowdStrike Falcon Pro

    AndroidiOSWebAPI
    7.1From $99.99 a year
    Visit
  6. 6

    Retrace

    Free planAndroidWebAPILinux
    6.9Free plan
    Visit