What is VirusTotal? Results, upload privacy and private scanning
VirusTotal combines file, URL and related security information from multiple engines and analysis systems. It is useful for investigating suspicious material and comparing signals. A clean result does not prove safety, and a detection count alone is not a reliable verdict. Before submitting anything, understand where the material and its results may be shared.
What happens in a standard analysis
The vendor’s service overview describes aggregation from antivirus engines, blocklists and other sources. Existing reports can sometimes be found by searching a file hash or an indicator, without submitting the file itself. That can be a sensible first step when a hash is already available through an approved process.
A report can include engine labels, timestamps, signatures, file characteristics, relationships and behavioral observations. Check which of those are actually present and when they were produced. Several engines may rely on related technology, so a count of detections is not a count of fully independent experiments.
Standard uploads can expose sensitive material
VirusTotal states that standard submissions and results are shared within its ecosystem, including security partners, and that submitted content can be available to certain customers. Do not put confidential documents, customer data, credentials, proprietary code or URLs containing private tokens into a public submission workflow merely to find out whether they are safe. An unguessable URL can become sensitive data when it is submitted to another service. Read the vendor’s sharing explanation before uploading.
Use your organization’s approved incident-response process. Preserve evidence according to that process, avoid executing suspicious files, and investigate on appropriately isolated systems. This page does not require you to upload or run a sample.
How Private Scanning differs
VirusTotal Private Scanning is a distinct paid capability with specific access requirements and a dedicated submission path. The documentation says private submissions are restricted to the organization and are not shared with other users or partners through that private workflow. It also says these analyses do not include the antivirus and URL-scanning partner verdicts supplied by standard scanning. Static, behavioral and contextual analysis can still be available.
| Question | Standard scanning | Private Scanning |
|---|---|---|
| Sharing expectation | Material and results can be shared within the VirusTotal ecosystem. | Organization-restricted under the documented private workflow and contract. |
| Partner antivirus verdicts | Part of the standard aggregation when available. | Not provided by the private-scanning workflow. |
| Access | Subject to standard service and API terms. | Specific paid privileges and private submission interface. |
| Retention | Do not assume an uploaded sample is temporary. | Check the configured retention and contractual terms. |
Using a paid account in the ordinary upload form does not by itself turn that upload into a private submission. Confirm the exact form or API endpoint. Private scanning is also not an automatic finding that a file is safe or that an organization meets every legal or contractual obligation.
How to read a report without overclaiming
- Confirm identity: compare the hash, file size and expected origin. A familiar filename can refer to different bytes.
- Check freshness: an old report may predate new detections, changes in a URL or a software update.
- Read the individual labels and behavior. Generic or potentially unwanted software labels need context.
- Check provenance and signatures against the expected publisher; a signature is evidence to investigate, not an absolute safety guarantee.
- Correlate with endpoint telemetry, network activity and the reason the item was flagged. Record uncertainty and escalate when appropriate.
Livehunt, Retrohunt and API limits
Retrohunt applies YARA rules to a historical sample corpus within the product’s limits. It is not simply a name for watching an old report’s score change. Livehunt is aimed at matching newly arriving material. Confirm current access, coverage and limits before building a workflow around either feature.
The Public and Premium API documentation distinguishes their terms and capabilities. Do not assume that a free API key authorizes a commercial product integration or unlimited scanning.
Common questions
Does zero detections mean a file is safe?
No. It means the available report did not show detections from the participating engines at that time. New threats, incomplete coverage and unobserved behavior remain possible.
Does one detection prove malware?
No. It warrants investigation in context; false positives and differing classifications exist.
Can I use it instead of endpoint protection?
It supplies investigation signals, rather than replacing a full prevention, detection and response process.
Related guidance
Record decisions and evidence using our revision-log template. For evaluating claims returned by web tools, see Tavily and evidence verification. No files were submitted to VirusTotal to create this guide.