shouldiuse.io

Categories

VERDICT

VirusTotal Review

Worth it

Should I use VirusTotal?

VirusTotal - virustotal.com

· 3 hours ago

Buy the free tier: it is the de facto standard for checking suspicious files and URLs before you trust them. Skip the paid tiers unless you run a SOC or threat-intel program with budget — pricing is quote-only.

Confidence

Medium. Based on 20+ public sources; several review snippets were truncated, so quotes use verbatim thread titles.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo clear evidence in sources
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
PremiumContact sales

Best for

  • Security analysts triaging suspicious files
  • Developers vetting downloads and dependencies
  • SOC teams enriching alerts via API
  • Threat researchers hunting malware

Not for

  • Everyday users wanting antivirus protection — it scans, it doesn't protect
  • Anyone with confidential files — uploads become visible to the security community
  • Small teams wanting published pricing and self-serve checkout
  • Casual users — the free site already covers you; paid tiers are enterprise overkill

Gotchas - check before you buy

high

July 2023 accidental data leak exposed information on some registered users

medium

Premium API pricing is quote-only; Reddit users report difficulty getting numbers

medium

Public API rate caps hit quickly; one thread complains about per-hour request limits

medium

Uploaded files are shared with the community; official guidance urges responsible use

Pros and cons

Pros

  • Aggregates many antivirus engines into one free file and URL check
  • Free public API available for basic automation
  • Google-owned since 2012; widely referenced across the security community
  • Deep threat-intel tooling: hunting, collections, vulnerability exploration
  • Community default for vetting suspicious downloads before running them

Cons

  • Premium pricing hidden behind sales contact
  • False positives are a recurring user complaint
  • Free API rate limits break automation at modest volume
  • Not real-time protection; scan verdict trust is debated

Sources & method

- 14 sources - Google-owned with an active bug bounty, but a 2023 accidental customer-data leak was disclosed and apologized for.

official x3review x7security x3news x1
  • Customer data leak (July 2023), An accidental exposure leaked data belonging to some registered users; VirusTotal issued a public apology.
  • Third-party AV engine RCE flaw (2022), A vulnerability in a third-party antivirus engine run on VirusTotal could trigger remote code execution; it was patched.
  • Arbitrary email signup bug, A reported bug allowed signup with an arbitrary email address, filed via Google's vulnerability reward program.

Key stats

  • Value for money: 4/5

    Rating

  • $0

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 4/5. Generous free tier; premium pricing opaque
  • Ease of use: 4/5. Simple file/URL paste-and-scan, per reviews
  • Feature depth: 5/5. Hunting, collections, vulnerability intel for pros
  • Support quality. No clear evidence in sources
  • Security posture: 3/5. 2023 data leak; Google-owned, bug bounty active
  • 4.3/5 RFP.wiki rating 102 reviews
  • Yes Free tier Website scanning + public API
  • Quote only Premium price No public price list
  • Since 2012 Owned by Google Acquired Sept 2012

Pricing

Free

$0

  • Website and app file/URL scanning
  • Public API with rate limits

Premium

Not disclosed

  • Premium API with higher quotas
  • VirusTotal Intelligence, LiveHunt, enterprise collections

Security

Google-owned with an active bug bounty, but a 2023 accidental customer-data leak was disclosed and apologized for.

  • Customer data leak (July 2023)An accidental exposure leaked data belonging to some registered users; VirusTotal issued a public apology.10
  • Third-party AV engine RCE flaw (2022)A vulnerability in a third-party antivirus engine run on VirusTotal could trigger remote code execution; it was patched.11
  • Arbitrary email signup bugA reported bug allowed signup with an arbitrary email address, filed via Google's vulnerability reward program.12

Alternatives

Compare VirusTotal with each alternative.

  • Intezer

    Deeper malware analysis and code triage than multi-scanner verdicts.

  • ThreatAnalyzer

    Sandbox-based alternative compared directly against VirusTotal.

  • alphaMountain

    Threat-feed alternative positioned as best-of-breed versus VirusTotal.

Full analysis

Based on 20+ public sources; several review snippets were truncated, so quotes use verbatim thread titles.

Free, industry-standard malware scanner for files and URLs. Don't pay unless you need enterprise threat intel — pricing is opaque.

Methodology

Based on 20+ public sources; several review snippets were truncated, so quotes use verbatim thread titles.

Read how a report is made.

Sources

  1. Google buys cybersecurity startup VirusTotalreuters.com
    news
  2. VirusTotal vs ThreatAnalyzer - Comparisonrfp.wiki
    review
  3. VirusTotal Reviews - G2g2.com
    review
  4. VirusTotal Cost & Reviews - Capterra AUcapterra.com.au
    review
  5. Is VirusTotal just false alarming??? - Redditreddit.com
    review
  6. More than 1000 requests per hour complaints - Redditreddit.com
    review
  7. VirusTotal Premium API pricing? - Redditreddit.com
    review
  8. Public vs Premium API - VirusTotal docsdocs.virustotal.com
    official
  9. VirusTotal Premium Services Catalogassets.virustotal.com
    official
  10. VirusTotal apologizes for customer data leakcybersecuritynews.com
    security
  11. Third-party AV flaw on VirusTotal triggering RCEizoologic.com
    security
  12. Arbitrary email signup bug - Google VRP reportbughunters.google.com
    security
  13. Do you trust VirusTotal scan results? - Wilders Securitywilderssecurity.com
    review
  14. VirusTotal 101: How to use responsibly - VMRayvmray.com
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.