Retrieve live feed of all URLs submitted to VirusTotal
Private API
This endpoint is available in the Private API only.
This endpoint allows you to retrieve a live feed of reports on absolutely all URLs scanned by VirusTotal. It requires you to stay relatively synced with the live submissions as only a backlog of 24 hours is provided at any given point in time.
The package argument indicates a time window to pull reports on all items received during such window. Only per-minute and hourly windows are allowed, the format is %Y%m%dT%H%M (e.g. 20160304T0900) or %Y%m%dT%H (e.g. 20160304T09). Time is expressed in UTC.
The response is a bzip2 compressed tarball. For per-minute packages the compressed package contains a unique file, the file contains a JSON per line, this JSON is a full report on a given URL processed by VirusTotal during the given time window. The URL report follows the exact same format as the response of the /url/report endpoint when allinfo=true is provided. For hourly packages, the tarball contains 60 files, one per each one-minute window.