Question

I am trying to scan URLs with VirusTotal service API but always receive response_code = 1 even if URL don’t exists:

stdClass Object
(
    [permalink] => https://www.virustotal.com/url/a92faaf82a911b2fe10ecbc51c6432f903b2a66d0686d6be0eeec78abf17cded/analysis/1348649385/
    [resource] => http://www.sdfjiodsffnsdklfjksdhf.com/
    [url] => http://www.sdfjiodsffnsdklfjksdhf.com/
    [response_code] => 1
    [scan_date] => 2012-09-26 08:49:45
    [scan_id] => a92faaf82a911b2fe10ecbc51c6432f903b2a66d0686d6be0eeec78abf17cded-1348649385
    [verbose_msg] => Scan request successfully queued, come back later for the report
)

But in above manual they write:

“response_code: if the item you searched for was not present in VirusTotal’s dataset this result will be 0. If the requested item is still queued for analysis it will be -2. If the item was indeed present and it could be retrieved it will be 1. Any other case is detailed in the following sections.”

I am using VirusTotalApiV2 class for that.

Answer 1

Have received the answer from support:

Hello,

Perhaps the documentation is not clear enough.

Whenever you send a URL for scanning, the URL might or might not be
scanned in that same moment, what you are doing is you are enqueuing
it for scanning. The response_code equal to one means that your
enqueuing was successful and the scan will be performed as soon as
possible (the API has a lower priority than the web interface).

In order to retrieve the scan results you must come back at a later
time and ask for them using:

https://www.virustotal.com/documentation/public-api/#getting-url-scans

The ideal work flow would be as follows:

1) Check whether the URL was already scanned in the past using:

https://www.virustotal.com/documentation/public-api/#getting-url-scans

If it was indeed scanned and the scanning date is recent enough just
use the report you just retrieved, if not go to [2].

2) Ask for a scan using:

https://www.virustotal.com/documentation/public-api/#scanning-urls

3) Wait for a while (couple of hours to be on the safe side) and ask
for the report on the URL:

https://www.virustotal.com/documentation/private-api/#getting-url-scans

If it still was not scanned just wait another while and poll the API
at a later time.

Hope this is clear, please do not hesitate to contact us if you still
run into problems.

Regards.