# VirusTotal Domain Votes via Locus x402

> VirusTotal Domain Votes via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-15).

Retrieves community vote data (harmless vs malicious) for a domain from VirusTotal's threat intelligence platform, paid via x402 micropayment.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/domain-votes
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-domain-votes-via-locus-x402-eb245bf0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_h-3fFSkPH-yiPDCJBnmOh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-domain-votes-via-locus-x402-eb245bf0 -d '<json body>'
```

Example prompt: Can you check the VirusTotal community votes for the domain 'suspicious-site.ru' and tell me how many people flagged it as malicious versus harmless?

## When to prefer this

Choose this endpoint when you specifically need community vote sentiment (harmless vs malicious counts) for a domain rather than raw antivirus scan results. It is ideal for quick reputation checks based on crowd-sourced security intelligence, and particularly useful when you want the human security community's consensus rather than automated engine verdicts. The x402 micropayment model makes it suitable for on-demand, per-query lookups without subscription overhead.

## Known failure modes

- Domain not found in VirusTotal database — returns empty data object
- Invalid or malformed domain name input — may return error or empty result
- Payment failure via x402 — transaction not settled, no data returned
- Rate limiting or quota exceeded on the VirusTotal backend
- Domain has no community votes yet — returns zero counts

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing community vote data for the queried domain, including counts of 'harmless' and 'malicious' votes submitted by VirusTotal's security community, along with payment confirmation details (settled USDC amount, request ID, and status URL).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-domain-votes-via-locus-x402-eb245bf0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)