Pricing

Every plan reaches the whole dataset through every interface we ship: REST, MCP, TAXII, MISP and the web, and every indicator comes with the evidence behind it. What changes is how many of your own prefixes, networks and addresses you can watch, how quickly an alert reaches you, how many queries you can turn into feeds, and how far back you can look. Each step is ten times the credits for about three and a half times the price. Open research is free, with Pro volume and the full history, by application rather than by card.

Plan	Free	Solo	Most common Pro	By application Research	Team
	Free no card, no expiry	€29/mo excl. VAT €290/yr, two months free	€99/mo excl. VAT €990/yr, two months free	Free open research, non-commercial	€349/mo excl. VAT €3,490/yr, two months free
	Look up any address, pull the feeds, and watch three of your own prefixes, networks or addresses with a weekly alert. Seven days of history.	Thirty days of history, ten watches with a same-day alert, and 25 saved queries you can pull as feeds. A prefix of yours that shows up on a sensor reaches you the day it happens.	Ninety days, search across every captured payload, 25 watches and 100 feeds your firewall and SIEM poll, for integrations other people depend on.	Academic, independent, CERT or student work that will be published where anyone can read it.	One budget across a team and everything it automates: 200 watches with hourly alerts, a thousand feeds, and the full archive behind every question.
Daily credits¹	500	5,000	50,000	50,000	500,000
Requests per minute	10	30	60	60	300
Query window²	7 days	30 days	90 days	Full history	Full history
Watchlists³	10	25	100	100	1,000
Feed tokens per watchlist⁴	2	5	10	10	50
Alert subscriptions	3	10	25	25	200
Fastest alert cadence	Weekly	Daily	Daily	Daily	Hourly
Fastest feed digest	Daily	Hourly	Hourly	Hourly	Hourly
Support	Community, best effort	Email	Email	Email	Priority, with onboarding help
	Create a free account	Get Solo	Get Pro	Apply for Research	Get Team

no card, no expiry

Look up any address, pull the feeds, and watch three of your own prefixes, networks or addresses with a weekly alert. Seven days of history.

Daily credits¹: 500
Requests per minute: 10
Query window²: 7 days
Watchlists³: 10
Feed tokens per watchlist⁴: 2
Alert subscriptions: 3
Fastest alert cadence: Weekly
Fastest feed digest: Daily
Support: Community, best effort

€29/mo

excl. VAT

€290/yr, two months free

Thirty days of history, ten watches with a same-day alert, and 25 saved queries you can pull as feeds. A prefix of yours that shows up on a sensor reaches you the day it happens.

Daily credits¹: 5,000
Requests per minute: 30
Query window²: 30 days
Watchlists³: 25
Feed tokens per watchlist⁴: 5
Alert subscriptions: 10
Fastest alert cadence: Daily
Fastest feed digest: Hourly
Support: Email

Most common

€99/mo

excl. VAT

€990/yr, two months free

Ninety days, search across every captured payload, 25 watches and 100 feeds your firewall and SIEM poll, for integrations other people depend on.

Daily credits¹: 50,000
Requests per minute: 60
Query window²: 90 days
Watchlists³: 100
Feed tokens per watchlist⁴: 10
Alert subscriptions: 25
Fastest alert cadence: Daily
Fastest feed digest: Hourly
Support: Email

By application

Research

open research, non-commercial

Academic, independent, CERT or student work that will be published where anyone can read it.

Daily credits¹: 50,000
Requests per minute: 60
Query window²: Full history
Watchlists³: 100
Feed tokens per watchlist⁴: 10
Alert subscriptions: 25
Fastest alert cadence: Daily
Fastest feed digest: Hourly
Support: Email

€349/mo

excl. VAT

€3,490/yr, two months free

One budget across a team and everything it automates: 200 watches with hourly alerts, a thousand feeds, and the full archive behind every question.

Daily credits¹: 500,000
Requests per minute: 300
Query window²: Full history
Watchlists³: 1,000
Feed tokens per watchlist⁴: 50
Alert subscriptions: 200
Fastest alert cadence: Hourly
Fastest feed digest: Hourly
Support: Priority, with onboarding help

1One credit is one row of data returned, so an enrichment lookup costs 1 and a 100-row list costs 100.

2How far back a query may reach. Full history means the whole dataset, with no window applied.

3A saved query, pullable as a token-gated feed.

4One per consumer, so a leaked URL can be revoked on its own.

Prices are in euros and exclude VAT. Stripe adds VAT at checkout where it applies. A business in an EU country other than the Netherlands can enter its VAT number at checkout, and VAT is then reverse charged, so it pays the price shown here.

If you already subscribe, the buttons above switch your plan, and Stripe prorates the change on the next invoice. Invoices, the card, your VAT number and cancellation are in the billing portal. Cancelling stops the renewal, and the plan stays active until the end of the period you have paid for.

Every number above is read from the same registry the quota middleware enforces, so this page cannot promise a limit the platform does not apply. Responses carry an X-HoneyLabs-Quota-Remaining header so an integration can watch its own budget. The same plans, prices and limits are published as JSON at /pricing.json.

Applying for research access

No cost, 12 months, renewable

The dataset exists because people run sensors and publish what they find. If your work is going to be public, we would rather have it built on real data than on a sample. Academic, independent, CERT and student work all count, and we do not ask for an institution.

You get Pro's volume with the full history, because depth is the limit that decides whether a piece of work is possible at all. A ninety day window cannot answer a question about a campaign that ran longer than ninety days, at any request rate.

What we ask in return

You publish openly. A paper, blog post, talk, dataset or repository that anyone can read without paying or signing up.
You credit HoneyLabs. A link back, using one of the snippets below. That is the whole payment.
You share findings, not the raw dataset. Aggregates, figures and the specific indicators your work discusses are all fine. Republishing bulk raw data as a competing feed is not.
It is not inside a commercial product. Research that later turns into something commercial is fine, just talk to us when it does.

Email info@honeylabs.net with what you are looking into and roughly where it will be published. Two sentences is plenty, and if the work is already out there just send the link.

Attribution, ready to paste

Any of these is fine. A plain link in the text works too.

Plain text

HoneyLabs, honeypot threat intelligence. https://honeylabs.net (accessed 2026-11-03).

Markdown

Data from [HoneyLabs](https://honeylabs.net)

BibTeX

@misc{honeylabs,
  title  = {HoneyLabs: honeypot threat intelligence},
  author = {{HoneyLabs}},
  year   = {2026},
  url    = {https://honeylabs.net},
  urldate = {2026-11-03}
}

Putting HoneyLabs data in something you sell

The plans above cover your own organisation, including commercial use inside your own security work. If indicators, scores or enrichment derived from our data reach your customers, that needs a redistribution licence. Licences are annual, name the product they cover, and ask to be credited as the source. Processing the data first does not change this.

Ask about a redistribution licence

Past Team, or the data on your own terms

Bulk delivery to a bucket you own, or an on-premise copy. Neither fits a credit budget, so both are priced against what you need.

Talk to us

In every plan, including Free

Full lookup, search and payload search
CVE probing data and early-actor attribution
REST API, MCP endpoint and TAXII 2.1
MISP feeds and Microsoft Sentinel connector
IOC feeds for firewalls and SIEMs

Questions

What is a credit?

One row of data returned. An enrichment lookup costs one credit, a hundred-row list costs a hundred. The meter follows what you pulled, so a careful query stays cheap.

What happens when I run out?

Requests return a quota error until the day rolls over at midnight UTC. Nothing is charged automatically and no overage appears on an invoice. If you hit the ceiling often, the next plan up is cheaper than the time you spend working around it.

Why is the history window the interesting limit?

Volume decides how many questions you can ask. Reach decides which questions can be answered at all. Tracking a campaign, or showing that a CVE was probed before it was published, needs history no request rate can substitute for.

Can I put this in a product I sell?

Yes on Team, and talk to us first so we can size it properly. Redistributing the raw dataset as a competing feed is the one thing no plan covers.

Are the free MISP feeds going away?

No. The exploiter and malware-infrastructure feeds ship in MISP's own defaults and stay anonymous and unmetered. They are how most people meet us and they are not a trial.

Can I cancel?

Any time, from the billing portal on your dashboard. Cancelling stops the renewal. The plan stays active until the end of the monthly or yearly period you have paid for, and the account then moves to the free plan.

Is VAT included?

No. Prices exclude VAT, and Stripe adds it at checkout where it applies. A business in an EU country other than the Netherlands can tick "I'm purchasing as a business" on the Stripe page and enter its VAT number. VAT is then reverse charged and the total is the price on this page. Stripe emails a receipt and an invoice that show the VAT treatment.