VirusTotal

VirusTotal

The VirusTotal module interfaces with the VirusTotal API v3 to query IP addresses and domains.

Important

Data Attribution: All threat intelligence, reputation scores, behavioral tags, associated metadata, etc., extracted by this module are exclusively provided by VirusTotal.

API Key Required: This module relies entirely on the VirusTotal API. If no API key is configured (see API Credentials for instructions), the module will expose zero capabilities and will not execute, adhering to our Global Settings logic.

Configuration & Limits

By default, the module's rate-limiting is highly conservative, calibrated to accommodate the strict limitations of the Free VirusTotal Tier (4 requests per minute, 500 per day).

If you are using a premium VirusTotal API key, you can override these rate limits in your Network Configuration to achieve maximum performance. You can also adjust the depth of pagination and toggle subdomain scanning within the same configuration file.

---

1. IP Threat Intelligence

The module accepts IPv4 and IPv6 nodes, querying the IP address endpoint to extract:

• Passive DNS (PDNS): Automatically paginates through historical resolutions, extracting Domain nodes and tagging them with PDNS.
• Network Context: Extracts routing and ownership data, including ASN, CIDR, and Organization (AS Owner).
• Location & Identity: Extracts Geo coordinates (Country and Continent) and the JARM TLS fingerprint.
• Threat Scoring: Extracts malicious and suspicious conviction scores if the IP is flagged by security vendors.
• Tags: Extracts VirusTotal behavioral tags.
• Communicating Files: Queries the API for files that communicate with the target IP address. Extracts comprehensive file metadata including file hashes (SHA256), PE metadata, file names, magic bytes, dates, threat scores, classifications, categories, YARA/Sigma rules, IDS alerts, malware configurations, behavioral tags, sandbox verdicts, reputation, certificates, DEB/RPM info, etc.

---

2. Domain Threat Intelligence

Note

Strict Scope Validation: During deep DNS and SSL parsing, the module extracts hundreds of third-party domains (e.g., AWS CNAMEs, external MX servers, CDN SANs). To maintain a clean infrastructure graph, all extracted domains are strictly validated and flagged as Out of Scope if they do not belong to the target organization. See Scope Boundaries for the logic on how domains are classified and how to manually include or exclude them.

The module accepts Domain nodes (and optionally Subdomain nodes if enabled in your Network Configuration), extracting exhaustive metadata and performing deep infrastructure enumeration:

• Subdomain Enumeration: Paginates through associated subdomains, tagging them as PDNS.
  • Certificate Validation: Automatically checks the last HTTPS certificate for each subdomain. If the certificate is expired, it flags the subdomain with an Expired status. For details on how expired certificates are processed, see the Domains by Certs module.
• Deep DNS Parsing: Extracts and intelligently links a vast array of historical DNS records (e.g., A/AAAA, CNAME, MX, NS, TXT). The extraction logic is identical to the core DNS module.
• SSL Certificates: Deeply parses the last HTTPS certificate to extract domains from the Subject Alternative Name (SAN) field (tagged San, and Wildcard if applicable), as well as the Cert Issuer, Cert Expiration, and Cert Fingerprint.
• Metadata & Reputation: Extracts community Reputation scores, Popularity Rank, Categories (by various providers), and Crowdsourced Context.
• Threat Scoring: Extracts malicious and suspicious conviction scores along with the names of the flagging engines.
• Communicating Files: Queries the API for files that communicate with the target domain. Extracts the same comprehensive file metadata as the IP endpoint.