Table of Contents
  • Home
  • /
  • Blog
  • /
  • How to Scan Bulk IOCs with VirusTotal?
February 13, 2024

How to Scan Bulk IOCs with VirusTotal?

How To Scan Bulk Iocs With Virustotal

If you have ever been part of security teams like the Security Operation Center (SOC) or CIERT teams, you might have dealt with many threat analyses as part of your incident response and malware analysis job. Capturing IOAs and IOCs and analyzing captured IOAs and IOCs are some of the crustal parts of the incident response and investigation procedure. And, of course, if you get lengthy lists of URLs, domains, IPs, and files, then its not just crustal, but also its a laborious task.

I still remember the early days of my professional job, where my team was used to get hundreds of URLs, domains, IPs, and file hashes from our security advisory partners to analyze and block them on all our security devices. We used to spend several hours just analyzing the captured IOCs every day. It was frustrating! The worst part is that the security services were not as mature as they are today. We must thank VirusTotal and other security services that have made security professionals lives a lot easier now. Today, we can automate such things with the help of services like VirusTotal combined with scripting languages like Python.

We created this post to help security analysts who need to validate or identify IOCs like URLs, domains, IPs, and file hash in bulk every day. We will show you a complete process to submit a list of IOCs to VirusTotal to the VirusTotals API using Didier Stevenss Python Script. Lets see what VirusTotal is and its API offerings. About Didier Stevens and his Python tools, automate the IOC scanning process by learning how to scan bulk IOCs with VirusTotal in this blog post.

Note: If you want to submit multiple files to VirusTotal to scan. See here.

A Short Note About VirusTotal and Its API Service

VirusTotal is a free online service that analyzes files and URLs, enabling the identification of viruses, worms, trojans, and other kinds of malicious content using antivirus engines and website scanners. It also enables the generation and sharing of threat intelligence with its huge URL and file analysis database.

VirusTotal offers both public and private APIs that allow users to programmatically interact with their services. The public API has some limitations, like only allowing 500 requests per day and 4 requests per minute. The private API, on the other hand, provides more flexibility and advanced capabilities like allowing users to choose their own request rate and quota, download submitted samples, get more detailed analysis reports, etc.

If you are an individual security researcher who wants to scan multiple URLs, domains, IPs, and file hash with VirusTotal less frequently, then public API services are enough to have. If you are working for a corporate company that needs to do a lot more than just scan URLs, domains, IPs, and file hash, then you should get private API services.

Public vs Private API

Here is a quick comparison of VirusTotals public and private APIs:

FeaturePublic APIPrivate API
Request rate limit500 requests/day, 4 requests/minFlexible based on service tier
File downloadNoYes
Additional metadataNoYes e.g. first submission date, prevalence etc.
File behaviorsNoYes
Advanced hunting APIsNoYes e.g. YARA based hunting

Didier Stevens and his Contributions to the Cybersecurity World

If you have been in the security landscape for some time, then you definitely know that Didier Stevens, is a renowned security researcher who has made numerous contributions to the cybersecurity community. He is the author of many popular open-source security tools written in Python, including:

  • oledump: to analyze OLE files like MS Office documents

  • pdf-parser: to analyze PDF documents

  • oletools: tools to analyze MS OLE2 files (Structured Storage)

  • peepdf: PDF analysis tool

  • VirusTotal: to search VirusTotal for hashes, URLs, IPs and domains

These are only a few tools that he created. He has tons of tools in his ToolSuite. However, these are quite popular tools that are very useful for malware analysts, forensics investigators, and security researchers to analyze and gather threat intelligence.

Anyways, these tools are not the point of discussion in this blog post. We have another tool or a Python script vtsearch to cover in this blog post. Didier Stevenss TirusTotal tool allows interfacing with VirusTotal APIs, making it easy to gather reputation data and scan bulk IOCs.

Prerequisites to Validate Bulk IOCs with VirusTotal

To start scanning bulk IOCs with VirusTotal, you need a few things in place:

  • VirusTotal API Key: The first requirement is to sign up on VirusTotal and get an API key. This key will be used to authenticate API requests. With the free public API key, you can make only 500 requests per day with a rate limit of 4 requests/min. For bulk scanning, it is recommended to get the private API key, which has higher rate limits.

  • Python Interpreter: You need Python 3.x installed to run the vtsearch tool. Python can be downloaded for all major operating systems from Make sure to add it to your PATH.

  • Python IDE (Optional): Using an IDE like PyCharm or Visual Studio Code can improve the development experience. But any text editor would also work.

  • vtsearch Tool: This is a modified Python tool which is originally created by Didier Stevens and is used to interface with the VirusTotal API. You can download it from Didiers blog or GitHub repo. This script was originally created to run on Python 2. We modified it to work on Python 3. Now this tool has been tested on Python 3.9.

Thats pretty much all you need to start submitting bulk IOCs to VirusTotal for analysis. Make sure Python and the vtsearch tool are configured correctly and you have the API key. Now we are ready to automate the scanning of bulk URLs, domains, IPs, and file hashes by programmatically interfacing with VirusTotal.

What can Capable to Do? is a Python program that is designed to search VirusTotal for hashes, IPs, domains, and URLs using free public APIs. And, returns the result to a CSV file and CLI. Some of its capabilities:

  • Customize delay time in sending search queries.

  • Force all queries to be sent to VirusTotal, even if found in a local database.

  • Calculate the md5 of the file and search it

  • File to keep track and skip not-found searches.

  • wait 1 hour when VirusTotal limitations exceeded

Why You Need to Submit IOCs to VirusTotal in Bulk?

The main intention of this program is to automate the IOC verification process in malware analysis, forensic investigation, or threat detection procedures.

Security Advisory or Threat Intelligence teams often share a list of IOCs with the Organizations Security Team in order to block the IOCs on their Proxy, Endpoint, Firewalls, SIEM, and other security solutions. You can use this script not only to identify the infected assets but also to curb the spread of malware infection on the corporate network.

Its a very well-known fact that not all security products are perfect and provide 100% protection against thriving threats. This script also helps Security teams to determine the list of IOCs that were flagged as malicious by the Vendors of their products and block them on their security products if not blacklisted and submit the unidentified IOCs to their vendors in order to block them globally.

How to Scan Bulk IOCs with VirusTotal?

The procedure is simple and straightforward. You just need to set up your Python environment with the VirusTotal API key. Just follow these steps to leverage VirusTotal APIs for scanning multiple IOCs in an automated manner:

Step 1: Signup on VirusTotal and Acquire API Key

  • Go to and create a free account.

  • Navigate to your Profile and note down the API key provided. This will be used for authentication.

Step 2: Download the vtSearch script

Download the Python script from here and place it on your machine. We copied it to the c:\\TheSecMaster Directory on our machine.

Download the Script from Git.

Step 3: Install Python interpreter

  • Download the latest Python 3.x from and install it.

  • Add Python to a PATH environment variable.

How to Install Python:

To ensure Python interpreter is working on your machine, run this command: python -V

Step 4: Install PyCharm or Conda (Optional Step)

This step is totally optional. You can use any code editor of your choice. We recommend using either Pycharm or Visual Studio Code as it has excellent Python support through extensions.

For this demo, we will use PyCharm as our chosen IDE for Python development. You can check out how to install PyCharm on Windows here.  If in case you are not a fan of any IDE, you can directly download the Python interpreter and use it on your CLI.

Download and install PyCharm Community Edition from Make sure to customize the installer to add Anaconda Python environment support.

Once setup is complete, open PyCharm. Open the directory in the vtSearch script is kept.  Go to File > Open > Browse the directory. Click the gear icon and select Add. Locate the Python executable in the <conda env> folder in the Anaconda installation.

Dont forget to add the VirusTotal API key to the script. As you can see, we have added our API in Line #14.
IMP Note: Replace this key with your own key. We deleted this API key before we published this post. You cant use this API key shown in the screenshot.

As soon as you open the directory, PyCharm will create an isolated Virtual Environment for this project. Make sure the Python interpreter is configured for the project. To set up the Python Interpreter in your PyCharm, Click on the gear icon in the top right corner, then click on Setting. If you dont have the Python interpreter, click on Add Interpreter, browse, and select the Python.exe file.

Great! Now your PyCharm is configured to run the script.

Let us know if you need any help setting up the IDE.

Step 5: Run the Python script to Submit bulk IOCs to VirusTotal

Before running the lets learn about a couple of arguments to pass. This script accepts arguments like -f, -t, -e, and -d.

-f: It is a flag used to indicate the file has a list of md5 hash values.

-t: It is a flag used to indicate the file has a list of IPs, URLs, or Domains.

-e: It is a flag used to indicate the file has a list of sha256 hash values. 

Some examples to Run the script:

  1. python -f hashes.txt

  2. python -t url urls.txt

  3. python -e sha256 hashes.txt

  4. python -f d 30 hashes.txt

We have a file Sample.txt in that we saved 10 phishing domains. Lets run the script to scan the domains with VirusTotal.

python -t url Sample.txt

The script creates a csv file to save the results. Here is the content of the csv file.

Search TermRequestedResponseScan DateDetectionsTotalPermalink
tr.amjaadasia.com1109-10-2023 07:20690
beachcitiesradio.com1109-10-2023 07:201290
acagro.ru1109-10-2023 07:21290
suncontainerhouse.com1109-10-2023 07:22490
gpinhouse.com1109-10-2023 07:222091
craigvirginialaws.com1109-10-2023 07:231290
discriminatieverdientaandacht.nl1109-10-2023 07:231290
vgcrelbb.com1109-10-2023 07:24290 07:241590 07:25290

Step 6: Run the Python script using PyCharm (Optional Step)

Once The vEnv and Interpreter are ready, then set up the parameters to run the script. To set up the running parameters, Click on the 3 vertical dots. Select the parameters.

We set up -t url Sample.txt as the parameter and click on the Run button.

Another CSV file will be created, which looks like this.

Search TermRequestedResponseScan DateDetectionsTotalPermalink
tr.amjaadasia.com0109-10-2023 07:20690
beachcitiesradio.com0109-10-2023 07:201290
acagro.ru0109-10-2023 07:21290
suncontainerhouse.com0109-10-2023 07:22490
gpinhouse.com0109-10-2023 07:222091
craigvirginialaws.com0109-10-2023 07:231290
discriminatieverdientaandacht.nl0109-10-2023 07:231290
vgcrelbb.com0109-10-2023 07:24290 07:241590 07:25290

Manually analyzing and validating lengthy lists of IOCs is a repetitive, monotonous, and cumbersome task. But we can easily automate scanning bulk IOCs by utilizing VirusTotals API and open-source tools like vtsearch.

Key Advantages:

  • Faster than manual analysis Automated scanning of bulk IOCs is significantly faster than manual lookup.

  • Error-free No chances of human errors when using automation.

  • No human intervention needed Once scripted, you just need to run it for hands-free IOC scanning.

  • Fully automated Scheduling recurrent scans is easy to validate new IOCs automatically.

By leveraging VirusTotals API capabilities and Didier Stevenss handy vtsearch tool, security teams can supercharge their threat hunting and intelligence workflows.

Automating the scanning and validation of bulk IOCs like URLs, domains, IPs, and file hashes can save hundreds of hours of repetitive manual work. This allows highly skilled resources to focus on other high-priority tasks like threat analysis, hunting, response, and improving security posture.

In summary, if you frequently deal with large IOC lists as part of your job, do check out the vtsearch Python tool to easily submit bulk IOCs to VirusTotal.

We hope this article helped understand how to submit bulk IOCs to VirusTotal. Thanks for reading this post. Please share this post and help secure the digital world. Visit our website,, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive updates like this.  

Arun KL

Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.

Recently added

Application Security

View All

Learn More About Cyber Security Security & Technology

“Knowledge Arsenal: Empowering Your Security Journey through Continuous Learning”

Cybersecurity All-in-One For Dummies - 1st Edition

"Cybersecurity All-in-One For Dummies" offers a comprehensive guide to securing personal and business digital assets from cyber threats, with actionable insights from industry experts.



View All

Learn Something New with Free Email subscription