# VirusTotal URL Votes Lookup

> VirusTotal URL Votes Lookup is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-15).

Retrieves community votes (malicious/harmless) for a given URL from VirusTotal's threat intelligence platform

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/url-votes
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-url-votes-lookup-2ba87390
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1dwm015jeOQmadysK2iwn

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-url-votes-lookup-2ba87390 -d '<json body>'
```

Example prompt: Can you check how the VirusTotal community has voted on https://suspicious-example.com — how many people marked it as malicious versus harmless?

## When to prefer this

Use this endpoint when you specifically need community-sourced voting data (malicious vs harmless tallies) for a URL rather than automated antivirus engine scan results. This is ideal for quick reputation checks based on human security researcher consensus. Prefer this over file hash lookups when you have a URL to assess, and over full URL scan endpoints when you only need vote counts rather than detailed engine-by-engine results. Best suited for agents performing lightweight URL reputation triage at $0.055 per call via x402 micropayment.

## Known failure modes

- URL not found in VirusTotal database — returns empty data object
- Invalid or malformed URL input — may return error or empty response
- Payment failure — USDC payment via x402 protocol not settled, request rejected
- Rate limiting or quota exceeded on the underlying VirusTotal API
- URL has no community votes yet — returns zero counts

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing community vote data for the queried URL, including counts of malicious and harmless votes submitted by VirusTotal community members, plus payment confirmation details showing settled USDC amount and a request tracking ID.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-url-votes-lookup-2ba87390/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)