Pricing

Simple, transparent pricing

Start free. Pay only for what you use when you grow. Move to a flat monthly when scale demands it. No hidden fees, no long-term contracts, no surprises.

Free

For developers, security researchers, and side projects. No card required.

EUR 0 / forever

1,000 lookups per day

  • 1,000 lookups per day
  • Full threat intelligence access
  • ML profiling & scoring
  • Geolocation & ISP attribution
  • HMAC-authenticated API
  • Dashboard & analytics
  • Community support
Start Free
Business

For high-volume production traffic. Flat monthly with included request bundles.

EUR 99 / month

200,000 requests included

  • Everything in Pay-as-you-go
  • 200,000 requests included
  • EUR 0.0007 per additional request
  • Multi-location uptime probes
  • Branded status pages
  • SIEM export
  • Domain & email intelligence
  • Priority email support
Choose Business
Enterprise

For organizations with mission-critical workloads and custom requirements.

From EUR 1,499 / month

Custom volume tiers available

  • Everything in Business
  • Custom volume pricing
  • Dedicated account manager
  • Custom threat feeds
  • White-label status pages
  • 99.99% SLA guarantee
  • Real-time log viewer
  • Slack, email & phone support
Contact Sales

About the EUR 10 Pay-as-you-go setup fee: we charge a one-time EUR 10 to verify your card, create your account, and keep spammers and abusers off the platform. It is not a hidden fee - it is the only setup cost, ever, and it keeps the platform clean for the customers who actually use it.

Choosing a tier

Which tier fits you?

Free

Just exploring. Building a side project. Researching threat intel. Want to try the platform without a card.

Pay-as-you-go

Production traffic with predictable bills. Want full control, no commitments, and the freedom to scale up or down with your traffic.

Business

High-volume production. Want a flat monthly bill, included request bundles, priority support, and the full set of operational features.

Enterprise

Mission-critical infrastructure. Need custom feeds, dedicated SLA, white-label, and a team on the other end of the phone when something matters.

What you actually pay for

Intelligence that stays fresh

Stale blocklists are worse than no blocklists. Every record in Panthero is refreshed at the cadence its threat category deserves - from real-time profiling of brand-new attackers all the way to long-lived malicious networks revalidated up to every 30 days.

No flat schedules. No blanket TTLs. Every plan, including Free, queries the same continuously refreshed intelligence engine - powered by 70+ public sources and our own sensor network deployed on real production infrastructure.

Refresh windows by threat category

Live sensor catches Real-time
Active brute-force attackers Hourly
Web attackers and scanners Every few hours
Anonymous infrastructure Every few hours
Botnets and C2 infrastructure Daily
Spam and abuse sources Daily
Long-lived malicious networks Up to 30 days

Compare plans

Feature comparison

Feature Free Pay-as-you-go Business Enterprise
Threat intelligence (224M+ records)
ML profiling & scoring
Geolocation & ISP attribution
HMAC-authenticated API
Dashboard & analytics
django-panthero middleware
panthero-agent (.deb)
Uptime & health monitoring
Multi-location probes
Branded status pages White-label
SIEM export
Domain & email intelligence
Custom threat feeds
Real-time log viewer
Hosts (servers / properties) 1 No limit No limit No limit
Daily lookup cap 1,000 No cap No cap No cap
SLA Best effort 99.9% 99.9% 99.99%
Support Community Email Priority email Slack, email, phone
Pricing EUR 0 EUR 0.001/req From EUR 99/mo From EUR 1,499/mo

Ready to get started?

Set up in minutes. Start free. Upgrade when you grow. Cancel anytime - no contracts, ever.