For quite a long time, I've been calculating hashes for files locally on my computer and then made requests such as:


That normally returns a JSON blob full of juicy information which my system uses to determine if a file is "clean" or not. Since a few days, I just get this returned instead of the AV scan result report:

    "error": {
        "code": "RecaptchaRequiredError",
        "message": "Please re-send request with a valid reCAPTCHA response in the \"x-recaptcha-response\" header"

If I go to:


It shows no results anymore. Looking in Pale Moon's network tab, I notice something very strange:

  1. It makes a POST request to https://www.virustotal.com/ui/signin with the to-me-unknown response code "429 No Reason Phrase".
  2. It also makes a GET request to the JSON URL I mentioned in the beginning, also returning "429 No Reason Phrase".

I have never heard of that HTTP status code. I also want to be clear that the webpage shows me nothing in the vein of a CAPTCHA, nor any "sign-in" to any kind of account. My conclusion is that Google has broken this service as well, just as they have done with Gmail and YouTube lately. I'm convinced that they are making an effort to exterminate all remaining non-Chrome-users or who automate anything.

So, assuming that this is not a "temporary glitch" (which is never the case), is there some real VirusTotal alternative yet? It really sucks that I had spent all this effort just to have it broken, but it was bound to happen sooner or later.

PS: Yes, I know that they have an API. That requires a Google account. I literally cannot register a Google account. They don't let me. Has not worked for 10+ years. But even if it did, I wouldn't want them to have a full history of every file/hash I scan.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.