VirusTotal Domain WHOIS API pricing
Is VirusTotal yours? Write to us about this page. We invite selected tool providers to our WhatsApp group.
33% complete: 3 of the 9 fields on our checklistSee the 9 fields
$0.00per 1,000 domainsWe haven't run VirusTotal through our domain WHOIS API benchmark yet.This plan is free. We leave this plan out of our price ranking because the provider bans business use. We rank 587 plans for domain WHOIS APIs by price. Half the plans cost $1.54 or less per 1,000 domains. 133 domain WHOIS API plans on our price sheet are free. WhoisRequest's free plan scores highest of the free plans in our benchmark, at 96.9 out of 100.Searchwire's $10 pack is the cheapest paid plan per 1,000 domains. Searchwire's domain WHOIS API costs nothing beyond the plan price. UAPI's CNY 4.90 pack costs the least for 10,000 domains a month: about $0.73.WhoisRequest, thenetworkery and FluentEDI are the best domain WHOIS API providers in the Datacircle benchmark.
Plan: Public API one of VirusTotal's 2 plans
Call:
GET / VirusTotal's only call for this APIAPI: Domain WHOIS API one of VirusTotal's 3 APIs
About this item
- Freshness. We don't know how fresh this plan's data is.
- 3 of the 9 fields on our checklist. Registrar, Created on, Updated on.
- Nothing to pay. You get 500 requests a day. Calls stop once your requests run out. Daily API quotas are reset every day at 00:00 UTC.
- One call. You send
domaintoGET /. The call returns the domain's WHOIS record.api/ v3/ domains/ {domain} - Who can get it: anyone registered in VirusTotal Community, non-commercial use only. Keep data: with conditions. Use data: with conditions.
VirusTotal: domain WHOIS API alternatives
VirusTotal alternatives: other domain WHOIS API providers by price
We list other providers' plans closest to this plan in price per 1,000 domains.
| This planVirusTotal, free | WhoisRequest, free, GET /api/v1/lookup/rdap/{domain name} | thenetworkery, free | FluentEDI, free | DomainDetails, free, GET /api/rdap | Namechan, free API key | |
|---|---|---|---|---|---|---|
| $ per 1,000 domains | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Completeness | 33% | 11% | 100% | 67% | 67% | 33% |
| Billing | free | free | free | free | free | free |
| Pay | $0 | $0 | $0 | $0 | $0 | $0 |
| Enough for | 500 calls a day | not published | not published | no limit | not published | not published |
| Freshness | unknown | live | live | live | unknown | 1 hour |
| Who can get it | anyone registered in VirusTotal Community, non-commercial use only | anyone, no account or API key | anyone, to check systems they own, run or are authorised to test | anyone | anyone | anyone with a Google account |
Sources
From each provider's own pricing page and docs, and from what providers tell us. We read this row from these pages on 2026-11-08.
- cloud.google.com/terms/secops/service-terms
- docs.virustotal.com/docs/consumption-quotas-handled
- docs.virustotal.com/docs/difference-public-private
- docs.virustotal.com/docs/quota-consumption
- docs.virustotal.com/reference/domain-info
- docs.virustotal.com/reference/domains-object
- docs.virustotal.com/reference/overview
- docs.virustotal.com/reference/public-vs-premium-api
- virustotal.readme.io/llms.txt
Product details
The key fields this plan's answer can hold, then each filled column in its row on the sheet.
- Registrant, not in the answer
- Registrar
- Created on
- Updated on
- Expires on, not in the answer
- Name servers, not in the answer
- Statuses, not in the answer
- DNSSEC, not in the answer
- Abuse contact, not in the answer
| $ per 1,000 domains | $0.00 |
|---|---|
| Per | call |
| Billing | free |
| Also pays for | from the same budget: Get an IP address report · Get a file report · Get a URL analysis report |
|---|
| Units cap | hard |
|---|
| $ per 1,000 calls that find nothing | $0.00 |
|---|
| Their pitch | Get a domain report: given a domain, retrieves the pertinent analysis report including threat reputation and context produced by 70+ antivirus products/blocklists and a myriad of other security tools and datasets. |
|---|
| Keep data | Upon termination or expiration of the Agreement or the applicable Order Form, Customer will immediately delete all Platform Security Content, including from any cloud repositories, file directories, storage media, or any other location or instance where it may be stored [...] |
|---|---|
| Use data | "Customer will not, and will not allow End Users [...] to: i. Sublicense, distribute, publicly perform or display, or otherwise share or make accessible, directly or indirectly, any Platform Security Content or results from GTI, including without limitation, any Google API or interface, or portions thereof, to any third party. ii. Obtain or use any Platform Security Content except as specifically permitted, or use or attempt to use GTI to mine information in any way that could identify individual persons in their private capacity [...] or otherwise use GTI or Platform Security Content for any purpose other than to detect and prevent malware and other cyber threats in a non-commercial personal or organizational capacity. iii. Publicly attribute the Platform Security Content that Customer receives through GTI to any Security Partner [...] without the individual Security Partner's express written permission." [...] "The Public API must not be used in commercial products or services. The Public API must not be used in business workflows that do not contribute new files. You are not allowed to register multiple accounts to overcome the aforementioned limitations." |
| Pay | $0 |
|---|---|
| You get | 500 requests a day |
| Enough for | 500 calls a day |
| Expires | Daily API quotas are reset every day at 00:00 UTC |
| Per day | 500 |
|---|---|
| Per second | 0.067 (4 a minute) |
| Batch | 1 |
| Answer | in the call |
|---|
| You send | domain |
|---|---|
| Method | GET |
| Path | /api/v3/domains/{domain} |
| Plan | Public API |
|---|---|
| Who can get it | anyone registered in VirusTotal Community, non-commercial use only |
The 6 fields the plan's answer can hold
domain, registrar, creation date, updated date, WHOIS record, WHOIS record date