01 · Product name
SecurityTrails
Paid historical DNS and WHOIS, owned by Recorded Future since 2022.
Published by Recorded Future.
In short
SecurityTrails, at securitytrails.com, sells current and historical DNS and WHOIS. On 4 January 2022 Recorded Future announced that it had acquired the company. The pricing page lists Professional at $500 a month for 20,000 queries, Business at $1500 a month for 65,000 queries, and Enterprise as contact us with a flexible quota. It does not print a free allowance. A past address is a lead for an origin behind a CDN, not proof of the host that answers now. The public owasp.org pages did not load on 16 Oct 2026.
Product pricing strategy
02
Premium
The SecurityTrails pricing page, opened 16 Oct 2026, lists three plans and no free column. Professional is $500 a month for 20,000 queries a month. Business is $1500 a month for 65,000 queries a month. Enterprise is Contact Us, with the volume cell set to Flexible. Those are the only amounts on that page. The grid names historical DNS, subdomains, current and historical WHOIS, reverse WHOIS, reverse DNS, associated domains, and a DSL. Check marks did not survive the page text, so a feature is not assumed to be in every column. The API page adds one gate in words: IP DSL queries require the Professional plan or higher. The quota document says a monthly quota, once spent, returns HTTP 429, and that a per-second throttle resets after one second. It does not print the requests-per-second number, and it does not print a free-tier allowance. A Recorded Future contract is a different quote. Do not copy these query caps onto that platform.
Utility and features
03
SecurityTrails is the DNS and WHOIS product at securitytrails.com. On 4 January 2022, Recorded Future's press release said it had acquired SecurityTrails and would add an Attack Surface Intelligence Module to the Recorded Future platform. The SecurityTrails site and its API price list were still separate pages on 16 Oct 2026. Recorded Future's own listing in this directory is a quote. It is not this meter.
- History, not the live answer. The API page illustrates historical A records with first_seen and last_seen. An older address is a candidate for an origin behind a CDN. It is not the address that answers now.
- Pivots the pricing page names. The comparison includes subdomains, reverse WHOIS, reverse DNS, and associated domains. A shared name or address is a lead. Redacted WHOIS can return nothing.
- A monthly query cap. Professional is 20,000 queries and Business is 65,000. The docs say the overage response is HTTP 429. Enterprise is a flexible quota arranged with sales.
The pricing page is three columns. Professional is $500 a month and 20,000 queries a month. Business is $1500 a month and 65,000 queries a month. Enterprise says Contact Us, and the query cell says Flexible. The comparison names current DNS, historical DNS, subdomains, domain WHOIS, current WHOIS, historical WHOIS, reverse WHOIS, WHOIS searching, IP research, reverse DNS, a domain-specific language, associated domains, and consulting. The check marks in that grid did not come through with the page text, so this listing does not assign a row to a column. The API page does say that IP DSL queries require the Professional plan or higher.
The API page shows the shape of a historical address lookup: a GET to /v1/history/{hostname}/dns/a, illustrated with oracle.com and a sample record that has first_seen, last_seen, an organization, and an IP. That sample is the vendor's illustration. It is not a lookup run for this listing, and it is not owasp.org. The public domain pages for owasp.org, including the historical A view, stopped on a Cloudflare verification in the browser and returned no records.
The quota document says every subscription level has a monthly quota, that a spent quota returns HTTP 429, and that the service will warn you as you approach it. It recommends caching a domain or address you ask about repeatedly, and turning on auto-billing if a hard stop would break a job. Rate limiting is described as a per-second cap that resets after one second. The page does not print the number of requests in that second. The error document maps 401 to a missing or invalid API key, 403 to data the key cannot access, and 429 to quota or rate limit.
- 1
Look up a hostname you are allowed to assess. Read the current address before you treat any historical address as the origin.
- 2
If the current address is a CDN and an older A record names a different network, write both down and say which is historical. Confirm the older host only if you are authorized to touch it.
- 3
Spend reverse WHOIS and subdomain queries on a registrant string or an apex you already have a reason to map. Stop when the quota warning arrives. A 429 is the end of the pull, not a thin result.
- 4
Keep the API key out of tickets and screenshots. The error document says a request without a valid key is HTTP 401.
- 5
Use Amass or a DNS lookup you run yourself when you need names you can re-check. Use Shodan when the question is what an address answers on a port today.
Caveats
04
A SecurityTrails row is a record from the vendor's collection. It is not a live DNS answer and not proof of who operates the host. Historical A records are how people look for an origin that used to sit behind a CDN. The date range is the evidence. An address with an old first-seen date, or a null last-seen in a vendor sample, is not the address that answers today. Shared hosting and reassigned addresses make the same IP a false origin. Confirm with a lookup you run, and with Shodan if you need the current banner, only for a host you are allowed to assess.
The pricing page does not print a free query allowance. Professional and Business are the two self-serve prices, $500 and $1500 a month, at 20,000 and 65,000 queries. The quota document says a spent month returns HTTP 429 and that a per-second limit resets after one second. It never prints that per-second number. The error document separates 401, no valid key, from 403, data the key may not read, and from 429. Do not describe a 403 as an empty domain.
Recorded Future announced the acquisition on 4 January 2022 and said SecurityTrails data would feed an Attack Surface Intelligence Module. The SecurityTrails price list was still its own page on 16 Oct 2026. The check marks on that comparison did not come through in the text, so this listing does not claim that every named feature is in every column. The only feature gate stated in words on the API page is that IP DSL queries require Professional or higher. The browser never got past Cloudflare on the owasp.org domain pages, so no record from that domain is quoted here.
Potential use cases
06
- You are assessing a hostname you are allowed to look up, and the current address is a content-delivery network. Pull the historical A records and write the current address next to any older address, with the first-seen and last-seen dates the API returns. The older address is a candidate for a former origin. It can also be another CDN, a shared host, or an address that has been given to someone else. Do not request that address, and do not call it the origin, until a second source agrees and you are allowed to touch the host. The public owasp.org history page did not load on 16 Oct 2026, so this listing does not quote a record from it. The oracle.com JSON on the API page is the vendor's sample, not a live result.
- You already have a registrant email, an organization string, or an apex, and you need the other names tied to it. The pricing page lists reverse WHOIS, WHOIS search, subdomains, reverse DNS, and associated domains. Run the pivot the page actually names, and keep the query count against 20,000 or 65,000 for the month, whichever plan you bought. A privacy-redacted WHOIS record will not hand you an email. A subdomain list is not a scope document and not permission to scan. When the docs' quota warning shows up, stop. HTTP 429 means the month's allowance is spent, not that the domain has no more names.
- You are choosing the subscription before a recurring job. Professional is $500 a month for 20,000 queries. Business is $1500 a month for 65,000. Enterprise is a sales conversation and a flexible quota. IP DSL queries, the API page says, require Professional or higher. Cache repeats, which the quota document recommends, so a daily pull of the same apex does not burn the month on the first morning. A Recorded Future platform quote is a different product. Do not assume that contract includes these 20,000 or 65,000 SecurityTrails queries. Ask, and write down the answer.
Hard cases
The case where the first result is easy to over-read.
An old address is briefed as the origin
The historical A record is from another year, the current answer is a CDN, and the writeup says the old IP is where the site really lives. It might have been, once. It might have been the CDN's own address, a neighbor on shared hosting, or a block the provider has since assigned to someone else. Keep the first-seen and last-seen dates in the sentence. Say that the public owasp.org history view did not load, if that was the domain, so the claim is not from this listing's capture. Check the address in a current DNS answer and, if you are allowed, in Shodan. Drop the origin claim when those disagree. Do not scan the old address to make the paragraph true.
Questions
Is SecurityTrails free?
The pricing page does not list a free allowance. Professional is $500 a month for 20,000 queries, and Business is $1500 a month for 65,000. Enterprise is contact us. A request without a valid API key is HTTP 401.
Does a historical A record reveal the origin behind a CDN?
It is a lead. The API returns earlier addresses with first seen and last seen dates. An old address can be a CDN, a shared host, or an address that has since been reassigned. It does not prove which host answers for the name today.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
SecurityTrails API
https://securitytrails.com/corp/apiPricing
SecurityTrails pricing
https://securitytrails.com/corp/pricingDocumentation
SecurityTrails API quotas
https://docs.securitytrails.com/docs/quotas-rate-limitsDocumentation
SecurityTrails API errors
https://docs.securitytrails.com/docs/errorsDocumentation
Recorded Future acquisition release
https://www.prnewswire.com/news-releases/recorded-future-acquires-securitytrails-301453543.html