I think this response is the kind of thing that goes with the "7 million+ software licenses sold, almost 2,000 customers worldwide" text noted in the article.

I think this response is the kind of thing that goes with the "7 million+ software licenses sold, almost 2,000 customers worldwide" text noted in the article. This response does not hide the concrete facts of the situation, which I do think remains an unresolved problem. First of all, https://www.virustotal.com/en/documentation/private-api/ https://www.virustotal.com/en/documentation/private-api/ does not mention any prices. It says to get in touch. Boring. So I decided to try googling "virustotal private api cost", and bingo: I found a quote in the Hacking Team emails :D - https://wikileaks.org/hackingteam/emails/emailid/16069 https://wikileaks.org/hackingteam/emails/emailid/16069 As of 2013 - 5 years ago - the prices were: - 300 searches and downloads per month ... 500 EUR per month - 1,000 searches and downloads per month ... 1,000 EUR per month - 5,000 searches and downloads per month ... 2,000 EUR per month - 15,000 searches and downloads per month ... 3,000 EUR per month - 30.000 searches and 30.000 downloads per month .... 4,700 euros per month. - Unlimited searches and downloads per month... 8,250 euros per month For a somewhat more recent comparison, https://developers.virustotal.com/v2.0/reference#public-vs-private-api https://developers.virustotal.com/v2.0/reference#public-vs-p... notes that the private API allows just 4 requests per minute. Sounds like that could be the default tier and that things have gotten a lot more expensive over the past 5 years. ($10k per month in 2013... maybe it's double that now? Nice spare change for Google, eh - VirusTotal is a Google company.) But, once you sign up, you get access to a feed (https://developers.virustotal.com/v2.0/reference#file-feed https://developers.virustotal.com/v2.0/reference#file-feed) API call that will give you a JSON array of the last 24 hours' worth of uploaded files. Each item in the array includes a file download link, which you can fetch. There's also https://developers.virustotal.com/v2.0/reference#url-feed https://developers.virustotal.com/v2.0/reference#url-feed, the feed of all URLs scanned. This is less straightforward in terms of "we got 5000 passwords and keys today, woohoo" because the chances are (hopefully...) that the URLs being scanned are setup to let VirusTotal through but not anyone else. That said, this would likely give you valuable intel into internal network structures and so forth. (And, who am I kidding, a disconcerting number of organizations are going to have the areas surrounding the upload infrastructure horribly misconfigured.) I can totally see the standpoint of this report. This IS a pay-to-play data exfiltration system. You get everything. Regardless of who you are.