Passive DNS Lookup via VirusTotal

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.