# VirusTotal IP Report via Locus x402

> VirusTotal IP Report via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-15).

Retrieves a threat intelligence report for a given IP address, checking it against 70+ antivirus engines and security tools via VirusTotal.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/ip-report
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-ip-report-via-locus-x402-12104d6d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Wjq7Mq37fz-QmsbsAniul

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-ip-report-via-locus-x402-12104d6d -d '<json body>'
```

Example prompt: Can you check if the IP address 185.220.101.45 is flagged as malicious on VirusTotal — I want to see how many security engines have flagged it and what kind of threat it is?

## When to prefer this

Choose this endpoint when you need rapid, pay-per-query IP threat intelligence without a VirusTotal API subscription or monthly commitment. Ideal for AI agents that need on-demand IP reputation checks using crypto micropayments (x402/USDC), especially in automated security workflows where only occasional IP lookups are needed. Prefer over direct VirusTotal API integration when managing API key overhead is undesirable or when building on x402 payment rails.

## Known failure modes

- Invalid or malformed IP address returns an error response
- Private/reserved IP ranges (e.g. 192.168.x.x) may return limited or no threat data
- Payment failure or insufficient USDC balance prevents the query from executing
- Rate limiting or VirusTotal API quota exceeded may result in errors
- Network timeout if the upstream VirusTotal API is slow or unavailable

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing VirusTotal's full threat intelligence report for the queried IP address, including detection verdicts from 70+ security engines, reputation scores, associated malware, country of origin, and other threat metadata. Also includes payment confirmation details (settled USDC amount) and a request ID for status tracking.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ip": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-ip-report-via-locus-x402-12104d6d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)