Contents
  1. Quick Start
  2. Main Parts of the UI
  3. Understanding Status Signals
  4. Working with the Free API
  5. Rescan and Reanalyze
  6. False Positive Disputes
  7. Common Workflows
  8. Tips for Better Results
  9. Troubleshooting

User Guide

VirusTotal Domain Monitor helps you monitor domain reputation through the official VirusTotal API from inside your browser. It is meant for people who manage domains and websites — it is not an antivirus and it does not block sites.

Quick Start

  1. Install the extension from your browser's store.
  2. Create a free account at VirusTotal.
  3. Copy your Public API key from VirusTotal.
  4. Open the extension and verify the key.
  5. Add one or more domains to your watchlist.
  6. Choose how often watchlist domains should be checked.

Main Parts of the UI

Watchlist

Use Watchlist to manage domains you want to monitor over time. You can:

  • Add one domain manually
  • Bulk add many domains at once
  • Search the watchlist
  • Run a manual check
  • Reanalyze stale domains
  • Remove domains from the watchlist
  • Open the dispute workflow for flagged domains

Current Site

Current Site shows the domain from the active tab. Use it to see the current tab's domain status, run a manual check, add the domain to the watchlist, or open the VirusTotal page for that domain.

Current Site works with normal website domains. Internal browser pages, localhost, and IP-based pages are not supported.

Settings

Use Settings to save or update your VirusTotal API key, change the watchlist check interval, choose a rescan policy, see daily API usage, and re-open the setup guide.

Understanding Status Signals

Extension badge

The extension icon badge gives a quick signal for the active tab's domain:

BadgeMeaning
Clean — no vendors flagged the domain
!Suspicious — one or more vendors flagged as suspicious
XMalicious — one or more vendors flagged as malicious
?Unknown or stale data
...Queued or currently checking

Panel cards

The side panel shows a fuller view: domain name, verdict, last check time, VirusTotal stats, and a stale-data hint when the latest analysis is old.

Working with the Free VirusTotal API

This extension is designed to work with the free VirusTotal Public API. Important points:

  • You use your own API key
  • The free tier has daily and per-minute limits
  • The extension spaces requests to stay within those limits
  • The UI shows daily API usage
  • The usage counter resets at midnight UTC
  • Pause mode lets you stop background activity for one hour

Bulk Add + Check Now

If you choose Add + check now, the extension adds all parsed domains to the watchlist but only starts an immediate limited batch of checks. The rest can be checked later by schedule or manually.

Rescan and Reanalyze

VirusTotal data can become stale. You have two related tools:

  • Rescan policy — tells the extension when it should request fresh analysis for older data
  • Reanalyze — manual action for a stale domain

Reanalyze requests a fresh VirusTotal analysis first, then queues a follow-up check so the UI can pick up updated results.

False Positive Disputes

When a domain is flagged by vendors, the extension can help you work through false positives. The dispute drawer gives you:

  • Vendor-specific contact links when available
  • An email shortcut where possible
  • A ready-made dispute template
  • An AI prompt you can refine elsewhere
  • A per-vendor status tracker

Suggested workflow

  1. Open the disputed domain.
  2. Review which vendors flagged it.
  3. Use the template or AI prompt as a starting point.
  4. Submit the vendor form or send the email.
  5. Mark each vendor as Disputed or Resolved.

Common Workflows

Monitor your own production domains

Add all important domains to the watchlist and let the extension re-check them on a schedule.

Audit a client portfolio

Use Bulk Add to paste a set of domains or URLs, then start a limited immediate check batch.

Check the domain in the active tab

Open a site, glance at the badge, and open Current Site for details.

Follow up on stale results

Use reanalyze when a domain's VT data is too old to trust at a glance.

Work through a false positive

Open the dispute drawer, contact vendors, and track progress without leaving the extension workflow.

Tips for Better Results

  • Add only domains you really care about to the watchlist
  • Use longer intervals if you are close to the free API limit
  • Reserve immediate checks for domains that matter right now
  • Use pause mode during low-priority periods
  • Review stale domains instead of assuming old verdicts are still accurate

Troubleshooting

The badge is empty

Possible reasons: the page is not a supported web domain, the extension is paused, the domain has not been checked yet, or there is no API key configured.

Current Site says the page type is not supported

This usually means the active tab is an internal browser page, localhost, an IP address, or a non-web page type such as file: or data:.

A domain shows Unknown

No result has been fetched yet, VirusTotal has no useful data for the domain, or your API key is missing or invalid.

A domain shows as stale

The extension still shows the last known verdict, but the latest VirusTotal analysis is old enough that you should reanalyze it.

I reached the daily limit

Wait for the counter to reset at midnight UTC, reduce manual checks, or increase the check interval for your watchlist.