# VirusTotal IP Comments Lookup

> VirusTotal IP Comments Lookup is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-15).

Retrieves community comments for a given IP address from VirusTotal's threat intelligence platform via x402 micropayment.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/ip-comments
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-ip-comments-lookup-527eefd3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0QDwakT_TnF1BvrZrgAaE

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-ip-comments-lookup-527eefd3 -d '<json body>'
```

Example prompt: Can you pull up the VirusTotal community comments for the IP address 185.220.101.45 — give me up to 20 comments so I can see what security researchers are saying about it?

## When to prefer this

Choose this endpoint when you need crowdsourced community threat intelligence and analyst commentary specifically about an IP address, rather than automated scan scores alone. Useful when you want qualitative human-written context from the security research community about a suspicious IP, complementing raw antivirus engine verdicts available via other VirusTotal endpoints.

## Known failure modes

- Invalid IP address format returns an error
- IP address not found in VirusTotal database returns empty data
- Exceeding rate limits may result in request failure
- Payment failure via x402 protocol prevents data retrieval
- Limit parameter out of acceptable range may cause error

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing community-submitted comments for the queried IP address from VirusTotal, along with payment metadata (settled USDC amount, authorization details) and a request ID for status tracking.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ip": {
   "type": "string"
  },
  "limit": {
   "type": "number"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-ip-comments-lookup-527eefd3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)