Reports / virustotal.com

virustotal.com

Generated 2026-10-03 07:00 UTC Refresh data

We found 134 subdomains of virustotal.com in certificate transparency logs, passive DNS and DNS brute force; 43 resolve right now, including docs.virustotal.com, developers.virustotal.com and support.virustotal.com. virustotal.com is registered with MarkMonitor Inc. since 2002-09-18 and expires 2027-09-18. Its SSL certificate from Google Trust Services expires in 42 days. For email it has an SPF record, DMARC set to quarantine and DKIM keys on 3 common selectors.

Registration: MarkMonitor Inc.Since 2002-09-18 · expires 2027-09-18
SSL certificate: 42 days leftGoogle Trust Services
Subdomains: 43 live134 discovered in total
Email authentication: SPF, DMARC, DKIMDMARC policy: quarantine

DNS records

7 of 7 types

GET/domain/virustotal.com/dns

A4	216.239.32.21 216.239.34.21 216.239.36.21 216.239.38.21
AAAA4	2001:4860:4802:38::15 2001:4860:4802:36::15 2001:4860:4802:32::15 2001:4860:4802:34::15
MX5	30 aspmx2.googlemail.com. 20 alt1.aspmx.l.google.com. 30 aspmx3.googlemail.com. 20 alt2.aspmx.l.google.com. 10 aspmx.l.google.com.
TXT4	"v=spf1 include:_spf.google.com include:_spf.zdsys.com include:mail.zendesk.com include:2567647.spf07.hubspotemail.net -all" "google-site-verification=i9iYxFW3ir0lIkCTNewpXhSOTBckiAO0H656epZ3HtQ" "google-site-verification=tQE2QW2ylRY5dnzKcEisvI9I0h1KA73FJjROvPii1Pk" "google-site-verification=Qq9eZi7f40MwYOcrV5vdApFIaFm4aneacq0Lzrcnugg"
NS4	ns-cloud-c3.googledomains.com. ns-cloud-c4.googledomains.com. ns-cloud-c1.googledomains.com. ns-cloud-c2.googledomains.com.
CAA4	0 issue "letsencrypt.org" 0 issue "pki.goog" 0 issue "digicert.com" 0 issue "sectigo.com"
SOA1	ns-cloud-c1.googledomains.com. cloud-dns-hostmaster.google.com. 2022110613 21600 3600 604800 300

Live lookup, cached up to 5 min.

WHOIS / RDAP

via rdap.org

GET/domain/virustotal.com/whois

Registrar: MarkMonitor Inc.
Registered: 2002-09-18
Expires: 2027-09-18
Last updated: 2026-08-17
Registry handle: 90372641_DOMAIN_COM-VRSN
Nameservers: ns-cloud-c1.googledomains.comns-cloud-c2.googledomains.comns-cloud-c3.googledomains.comns-cloud-c4.googledomains.com
Status: client delete prohibitedclient transfer prohibitedclient update prohibited

RDAP with port-43 WHOIS fallback, cached up to 1 h.

SSL certificate

Valid, 42 days left

GET/domain/virustotal.com/ssl

Issuer: Google Trust ServicesCN=WR3,O=Google Trust Services,C=US
Subject: virustotal.com
Valid from: 2026-08-16 16:49 UTC
Valid until: 2026-11-14 17:37 UTC
Serial number: 40494062328770912800893230247231953310
Names covered (1): virustotal.com

Live TLS handshake on port 443, cached up to 6 h.

Subdomains

43 live · 134 discovered

GET/domain/virustotal.com/subdomains

about.virustotal.com107.178.241.179
adrian-test-ui-cache.cloud.virustotal.com34.149.100.22
ai.virustotal.com34.8.238.115
api.dev.asm.virustotal.com34.149.132.237
api.prod.ma.virustotal.com35.241.7.212
api.stage.asm.virustotal.com34.98.74.26
assets.virustotal.com34.149.241.245
atlas-dev-service.cloud.virustotal.com34.8.46.110
atlas-service.cloud.virustotal.com130.211.4.51
avs-control.virustotal.com142.251.16.121
bigfiles.virustotal.com172.253.124.121
blog.virustotal.com142.250.9.121
dev.asm.virustotal.com34.149.132.237
developers.virustotal.com34.36.48.223
docs.virustotal.com34.117.229.111
go.virustotal.com199.60.103.228
gtidocs.virustotal.com34.120.189.126
identity-proactive.virustotal.com35.244.150.64
idp.prod.identity.proactive.virustotal.com35.244.150.64
karlh-test.cloud.virustotal.com34.70.130.251
looker.staging.virustotal.com34.54.8.247
looker.virustotal.com34.120.50.120
ma.virustotal.com34.117.43.50
net-analysis.internal.virustotal.com34.120.206.91
proactive-autopush.virustotal.com74.125.21.129
proactive-dev.virustotal.com209.85.201.129
proactive-staging.virustotal.com74.125.21.129
proactive.virustotal.comwww3.l.google.com
releases.virustotal.com172.253.122.121
rest.staging.virustotal.com172.253.63.121
scim.virustotal.com142.251.163.121
stage.asm.virustotal.com34.98.74.26
staging.ai.virustotal.com34.36.70.49
staging.virustotal.com172.253.124.121
support.virustotal.com216.198.53.11
tls.virustotal.com34.36.100.109
uberproxy-san.virustotal.com74.125.21.129
virustotal.com216.239.32.21
web-staging.virustotal.com199.36.158.100
www.virustotal.com34.54.88.138
yara-ci.cloud.virustotal.com35.241.53.81
yara-editor.virustotal.com35.201.120.131
zendesk1.virustotal.com216.198.53.2

91 more seen in CT logs and passive DNS that don't resolve now

alt003285.virustotal.com
alt003353371.virustotal.com
alt00605730.virustotal.com
alt0067871.virustotal.com
alt0067874.virustotal.com
alt00692188.virustotal.com
alt0070.virustotal.com
alt0075.virustotal.com
alt0076.virustotal.com
alt0078.virustotal.com
alt10970.virustotal.com
alt111567.virustotal.com
alt12346.virustotal.com
alt153817.virustotal.com
alt153871.virustotal.com
alt19450.virustotal.com
alt198030.virustotal.com
alt203456.virustotal.com
alt238615.virustotal.com
alt253312.virustotal.com
alt258174.virustotal.com
alt27488.virustotal.com
alt298072.virustotal.com
alt311714.virustotal.com
alt357161.virustotal.com
alt363291008.virustotal.com
alt363500.virustotal.com
alt4.virustotal.com
alt403084.virustotal.com
alt41750010.virustotal.com
alt4581653.virustotal.com
alt4581747.virustotal.com
alt480754.virustotal.com
alt480800.virustotal.com
alt4870019.virustotal.com
alt4950018.virustotal.com
alt503229.virustotal.com
alt508094.virustotal.com
alt511484.virustotal.com
alt511644.virustotal.com
alt605590.virustotal.com
alt61564.virustotal.com
alt61687.virustotal.com
alt67450.virustotal.com
alt6838.virustotal.com
alt7087972.virustotal.com
alt757298.virustotal.com
alt77569.virustotal.com
alt79599.virustotal.com
alt80632.virustotal.com
alt830124.virustotal.com
alt8464.virustotal.com
alt8507480.virustotal.com
alt8572620.virustotal.com
alt87428.virustotal.com
alt917671.virustotal.com
alt953484.virustotal.com
alt9889711.virustotal.com
alt995469.virustotal.com
api-intelligence.qa.ma.virustotal.com
api-staging.qa.ma.virustotal.com
api.asm.virustotal.com
api.intelligence.ma.virustotal.com
api.ma.virustotal.com
api.qa.ma.virustotal.com
api.virustotal.com
asm.virustotal.com
assets.ma.virustotal.com
atlas-dev.cloud.virustotal.com
atlas.cloud.virustotal.com
avs-control-lb.virustotal.com
clawhub.virustotal.com
dev.virustotal.com
doc.virustotal.com
identity.proactive.virustotal.com
idp.dev.identity.proactive.virustotal.com
idp.stage.identity.proactive.virustotal.com
legacy.virustotal.com
lmlmlm.virustotal.com
m.virustotal.com
mail.virustotal.com
sandbox-dispatcher.cloud.virustotal.com
staging.identity.proactive.virustotal.com
store.virustotal.com
vtmail2.virustotal.com
vtmail3.virustotal.com
vvv.virustotal.com
wandesign.virustotal.com
ww.virustotal.com
www2.virustotal.com
wwww.virustotal.com

Sources: rapiddns 35 · virustotal 121 · certspotter 14 · subfinder 13

From CT logs, passive DNS (25+ sources) and brute-force. Live means it resolves now.

Email security

GET/domain/virustotal.com/email-security

SPF Present

v=spf1 include:_spf.google.com include:_spf.zdsys.com include:mail.zendesk.com include:2567647.spf07.hubspotemail.net -all

DMARC Present

p=quarantine

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:mailauth-reports@google.com

DKIM 3 found

google._domainkeys1._domainkeys2._domainkey

Show public keys

google._domainkey.virustotal.com

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvzKRwrgmC0tOzxJ8+3IKkjw13BbnpNLQkcdU6vjEO4InRC1F1gDrp+YRNivnt8RGQOEtURiF5nYnDXRe18N1OO4BleUJKtDKE36Sd1MftYKxtyWuS7z5DDQVf7du3HvfaHvKfwBazp8WIubgEqUQj02+0OFc4QCTJ+46glIBWWQIDAQAB

s1._domainkey.virustotal.com

k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0S+pRlThcNQtTZ6VZWhOYSW4K+ysUo8awefw13XfzkQScRU6crk06VBMag1KZBLVC5edGgnEWn6hopTKHfWxh1ccsqsY0BsFKc1sgaPF2GBgbzkVeLVgdsEQ+voqdj8sPJUFjyrKcjcW0LaDu/hY1CqhdUBr+RaLd7m5M0usx8tFjfkCGoRqYOUS6xjlAIfa926siUllfc6Mhc06nbMzlFCrOuF9f1ugtrYSnRaG9ryiNMuM+Ac6n1KMkrfTnhPnwHlM/iSIro50u5UH6eSiOPqMHp7FMd0tNRUVryBs3UCccANyQvyp0fxr3ZjIs+sXDCtkABs9WXcrgKDOyLAWdwIDAQAB

s2._domainkey.virustotal.com

k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaFCJLfici7Y5Kg3fZX8l3UCmhTBpnQT15JFO5E+PPmxtxXSaYafUZWR1KVk02d4GSAO8F6pj/bx3EcNpV+KpuiqwOYYJjU2gkDe2OiH90Kk4K6zflwiAGzaH0d6bDL++jC+i+NavxO+iv0yw+pnnCIwmdfddzOGiaRi+qoZEAbwIDAQAB

DKIM checked on 29 common selectors; custom ones can't be discovered. Cached up to 1 h.

Get this report as JSON

One call returns everything on this page. Each section is also its own endpoint.

curl "https://domain-intelligence-api.p.rapidapi.com/lookup/virustotal.com" \
  -H "X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY"

import requests

r = requests.get(
    "https://domain-intelligence-api.p.rapidapi.com/lookup/virustotal.com",
    headers={
        "X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    timeout=30,
)
print(r.json())

// Node 18+ (built-in fetch)
const res = await fetch(
  "https://domain-intelligence-api.p.rapidapi.com/lookup/virustotal.com",
  { headers: {
      "X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
      "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  } }
);
console.log(await res.json());

<?php
$ch = curl_init("https://domain-intelligence-api.p.rapidapi.com/lookup/virustotal.com");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com",
    "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY",
]);
$data = json_decode(curl_exec($ch), true);
print_r($data);

1,000 requests a month free, no card Paid plans up to 5M a month ?wait=1 waits for every subdomain source to finish

Get free API key See pricing

More reports

x.com linkedin.com instagram.com reddit.com youtube.com tiktok.com pinterest.com twitch.tv All reports →