Quick take
Already sold on VirusTotal?
In this articleShow
Short answer: VirusTotal, owned by Google, lets you check a suspicious file, link, domain or IP address against dozens of antivirus engines and threat-intelligence sources for free. It's one of the fastest ways to get a second opinion before opening something. Two things matter most: read the results carefully (one or two detections are often false positives), and never upload private or confidential files, because uploaded files are shared with security researchers and paying customers.
What VirusTotal checks
- Files: scanned by 70+ antivirus engines, plus sandbox behavior reports for many file types.
- URLs: checked against dozens of URL and domain reputation services.
- Domains and IP addresses: reputation, DNS history, related files and certificates.
- File hashes: search a SHA-256 hash to see if a file is already known — without uploading it.
A VirusTotal report: detection count, engine-by-engine results and tabs for details, relations and behavior.
How to read results
Result | What it usually means |
|---|---|
0 detections | No engine flagged it — good, but not a guarantee (new malware may be missed) |
1–3 detections, generic names | Often a false positive or a "potentially unwanted program"; check which engines and names |
Many detections with consistent family names | Very likely malicious — don't open it |
URL flagged as phishing by several vendors | Don't visit or enter credentials |
Also check the Details (file type, signature), Relations (domains it contacts) and Behavior tabs, and the community comments.
The privacy catch
Files you upload become available to VirusTotal's premium customers (security vendors and researchers), who can download them. Never upload documents containing personal, financial, legal or company-confidential information. Instead:
- Search the file's hash (SHA-256) — if it's already known, you get results without sharing the file.
- Scan sensitive files with local antivirus instead.
On Windows, get a hash with `Get-FileHash .\file.exe` in PowerShell; on macOS/Linux, `shasum -a 256 file`.
VirusTotal Graph maps connections between files, domains and IPs — useful for investigators.
Free vs. paid
The public website and a rate-limited public API are free for non-commercial use. Paid tiers (part of Google Threat Intelligence) add advanced search, hunting rules, bulk API access and file downloads for security teams.
Example: checking a suspicious email attachment
- Don't open the attachment. Save it without running it, or note its name.
- Get its hash (PowerShell: `Get-FileHash .\invoice.zip`) and search it on VirusTotal.
- If it's unknown and not confidential, upload it. If it may contain sensitive information, scan it with local antivirus instead.
- Read the results: many detections with consistent malware family names means it's malicious. Report the email as phishing and delete it.
- Check the sender with our Email Header Analyzer to see whether it was spoofed.
- If you already opened it, disconnect from the network and run a full scan with your antivirus and Malwarebytes.
Checking a suspicious link
Paste the URL into VirusTotal's URL tab rather than clicking it. Also look at the domain itself: lookalike spellings and unusual top-level domains are red flags even when engines show zero detections, because brand-new phishing sites may not be flagged yet.
Good habits
- Check unexpected email attachments and download links before opening.
- Use our Email Header Analyzer alongside VirusTotal when a message looks suspicious.
- Remember that a clean result isn't proof of safety — if something feels wrong, don't open it.
Verdict
VirusTotal is an indispensable free second-opinion scanner for files and links. Use hash searches for anything sensitive, and treat results as one input rather than a final verdict.
Frequently asked questions
Is VirusTotal safe to use?
Yes, but uploaded files are shared with security researchers. Don't upload private documents.
Who owns VirusTotal?
Google, which acquired it in 2012. It's now part of Google's security and threat intelligence offerings.
Can VirusTotal remove malware?
No. It only scans. Use antivirus software such as Malwarebytes to remove infections.
Sources
- VirusTotal, How it works
- VirusTotal, Privacy notice
- VirusTotal, Public vs. premium API
The bottom line
