Skip to content

Check virustotal-scan-url

Overview

Analyses URLs to detect malware and other breaches using VirusTotal.

Hints:

  • In order to use this plugin, you will need to create a VirusTotal account.
  • This plugin uses the VirusTotal API v3. See the documentation on any constraints and restrictions, especially for commercial use.
  • Takes at least 60 seconds to execute.

Fact Sheet

Fact Value
Check Plugin Download https://github.com/Linuxfabrik/monitoring-plugins/tree/main/check-plugins/virustotal-scan-url
Check Interval Recommendation Once an hour
Can be called without parameters No
Requirements VirusTotal account, VirusTotal API key and Premium API if this plugin is used in business workflows that do not contribute new files or in commercial products/services.

Help

usage: virustotal-scan-url [-h] [-V] [--always-ok] [--insecure] [--no-proxy]
                           [--severity {warn,crit}] [--test TEST]
                           [--timeout TIMEOUT] --token TOKEN --url URL

Analyses URLs to detect malware and other breaches using VirusTotal.

options:
  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit
  --always-ok           Always returns OK.
  --insecure            This option explicitly allows to perform "insecure"
                        SSL connections. Default: False
  --no-proxy            Do not use a proxy. Default: False
  --severity {warn,crit}
                        Severity for alerting. Default: warn
  --test TEST           For unit tests. Needs "path-to-stdout-file,path-to-
                        stderr-file,expected-retc".
  --timeout TIMEOUT     Network timeout in seconds. Default: 8 (seconds)
  --token TOKEN         VirusTotal API token
  --url URL             URL to scan.

Usage Examples

./virustotal-scan-url --token b480bd43 --url https://secure.eicar.org/eicar.com

Output:

9/97 security vendors flagged https://secure.eicar.org/eicar.com as malicious.

Engine      ! Result     ! Method    ! Category           
------------+------------+-----------+--------------------
Antiy-AVL   ! malicious  ! blacklist ! malicious [WARNING]
AutoShun    ! malicious  ! blacklist ! malicious [WARNING]
BitDefender ! malware    ! blacklist ! malicious [WARNING]
CRDF        ! malicious  ! blacklist ! malicious [WARNING]
Fortinet    ! malware    ! blacklist ! malicious [WARNING]
G-Data      ! malware    ! blacklist ! malicious [WARNING]
Lionic      ! malware    ! blacklist ! malicious [WARNING]
Sophos      ! malware    ! blacklist ! malicious [WARNING]
URLQuery    ! suspicious ! blacklist ! suspicious         
VIPRE       ! malware    ! blacklist ! malicious [WARNING]

States

  • Alerts according to the given severity level (default: WARN due to the many false positives on VT) if the scanner's result falls into the "malicious" category.

Perfdata / Metrics

According to https://docs.virustotal.com/reference/analyses-object:

Name Type Description
harmless Number Number of reports saying that is harmless.
malicious Number Number of reports saying that is malicious.
suspicious Number Number of reports saying that is suspicious.
timeout Number Number of timeouts when analysing this URL.
undetected Number Number of reports saying that is undetected.
vendors Number Number of scan vendors used.

Credits, License