# VirusTotal DNS Resolution Lookup via Locus x402

> VirusTotal DNS Resolution Lookup via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-15).

Retrieves DNS resolution data for a specific IP-domain pair using VirusTotal's threat intelligence platform.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/dns-resolution
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-dns-resolution-lookup-via-locus-x402-275ffd2a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_afJCjDfH91R_Pc6IhT97Z

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-dns-resolution-lookup-via-locus-x402-275ffd2a -d '<json body>'
```

Example prompt: Can you look up the VirusTotal DNS resolution record for the pair 8.8.8.8 and google.com — I want to see what threat intelligence data comes back for that IP-domain resolution?

## When to prefer this

Use this endpoint when you need to look up a specific DNS resolution record (IP-domain pair) from VirusTotal's threat intelligence database, particularly when you already know the IP address and domain name you want to correlate. Prefer this over URL or file scanning endpoints when your investigation is specifically about DNS-layer relationships. The x402 micropayment model makes it cost-effective for per-query lookups without a VirusTotal API key subscription.

## Known failure modes

- Invalid resolution ID format (not IP+domain concatenated) returns an error or empty data object
- Unknown or unrecorded resolution ID returns empty data
- Payment failure results in request not being processed
- Rate limiting or quota exceeded on the VirusTotal backend
- Network timeout from the x402 gateway

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing DNS resolution data from VirusTotal for the specified IP-domain pair, along with payment settlement details (settled and authorized USDC amounts) and a request tracking object with a status URL for async polling if needed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "id": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-dns-resolution-lookup-via-locus-x402-275ffd2a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)