# VirusTotal IP Votes via Locus x402

> VirusTotal IP Votes via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-14).

Retrieves community voting data (malicious/harmless votes) for a given IP address from VirusTotal via a pay-per-call x402 micropayment proxy.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/ip-votes
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-ip-votes-via-locus-x402-f44d16c4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QGOEH7x-tN1SonvXllPrT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-ip-votes-via-locus-x402-f44d16c4 -d '<json body>'
```

Example prompt: Can you check the VirusTotal community votes for the IP address 185.220.101.34 and tell me how many users flagged it as malicious versus harmless?

## When to prefer this

Use this endpoint when you specifically need crowd-sourced community voting data (malicious/harmless votes) for an IP address from VirusTotal, and you want to pay per call via x402 USDC micropayments without managing a VirusTotal API key. Prefer this over direct VirusTotal API access when operating in an agent environment with x402 payment infrastructure already set up. This is distinct from antivirus engine scan results — use this for community consensus signals rather than automated engine detections.

## Known failure modes

- Invalid IP address format returns an error or empty data object
- IP not found in VirusTotal database returns an empty votes object
- Payment failure or insufficient funds results in a 402 response and no data
- Rate limiting or quota exceeded on the underlying VirusTotal API returns an error
- Network timeout or proxy unavailability returns a service error

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object with community voting data for the specified IP address, including counts of malicious and harmless votes submitted by VirusTotal users, along with payment confirmation details (settled USDC amount, request ID, and status URL).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ip": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-ip-votes-via-locus-x402-f44d16c4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)