VirusTotal API Rate Limit 429 Errors: Why Your IOC Enrichment Pipeline Keeps Stalling

VirusTotal enforces quotas on every API key across three separate windows: a per-minute limit, a daily limit, and a monthly limit, and any one of them can trigger a 429 independent of the others. On the Public API specifically, VirusTotal documents the per-minute ceiling at 4 requests and the daily ceiling at 500 requests. That is tight enough that most automated IOC enrichment pipelines are not failing because they are unusually aggressive; they are failing because a script written and tested against a handful of manual lookups was never paced to survive a real alert volume, where a single suspicious email or a single EDR detection can generate a dozen or more IOCs (sender IP, attachment hash, embedded URLs, C2 domain, dropped file hashes) that all get submitted at once.

The most common causes behind a pipeline that used to work and now doesn't:

Before changing anything, confirm which of the three quota windows is actually the constraint, because the fix is different depending on which one it is. VirusTotal's API v3 returns two distinct error codes under the same HTTP 429 status, and conflating them is the single most common reason a first attempt at a fix doesn't work.

The durable fix is architectural, not a bigger retry budget. Retrying faster against a quota that resets on a UTC clock does not make more requests succeed; it just spends more of tomorrow's error budget on logging failed attempts.

It's tempting to work around a tight Public API quota by registering several free accounts and rotating keys across them to multiply the effective request budget. VirusTotal's terms explicitly prohibit registering multiple accounts to circumvent Public API limits, and this is a policy violation that risks the accounts being disabled, not a legitimate scaling technique. If the Public API's quota is structurally too small for a legitimate use case, the documented path is contacting VirusTotal about a higher quota or moving to a Premium or GTI Enterprise key, not multiplying free accounts.

A fix that looks like it worked on the next test run and then quietly fails again during next month's alert spike hasn't been validated, it's just been re-tested at a smaller scale. Confirm the fix holds under real conditions before considering the pipeline fixed.

Caching, deduplication, and pacing solve the common case: a pipeline that was simply unpaced against a real alert volume. They do not solve every case, and it's worth naming the situations where the honest answer is that the Public API is the wrong tool rather than a pipeline that needs more tuning.

Escalate to VirusTotal directly, and budget for a Premium or GTI Enterprise key, once any of the following is true rather than continuing to tune around the Public API's ceiling:

A pipeline architected around a single enrichment source is also a pipeline that inherits that one vendor's quota ceiling as a hard operational constraint. Diversifying enrichment across multiple OSINT and commercial sources, so a VirusTotal quota exhaustion degrades enrichment coverage rather than stalling the pipeline outright, is worth building into the architecture from the start rather than after the first quota-driven outage; the roundup of best OSINT tools for threat intelligence covers alternative and complementary sources worth evaluating for that redundancy.