IPScanner
IP network class (residential, mobile, hosting, VPN, residential proxy, Tor) with a confidence score
Reputation of IPs, domains, URLs and file hashes from aggregated threat feeds, plus CVE lookups.
isMalicious API is a free Security API that requires apiKey authentication, is served over HTTPS and does not support CORS, so it should be called from a server.
Complete REST API reference for threat intelligence. Check domains, IPs, URLs and file hashes, download blocklists, and stream updates. OpenAPI 3.0 spec included.
Details from ismalicious.com.

Unified API suite · now live
Geocode an address, validate an email, track a flight or pull stock data with one account, one dashboard and one API key.
IP network class (residential, mobile, hosting, VPN, residential proxy, Tor) with a confidence score
Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC)
The isMalicious API is provided by isMalicious (ismalicious.com). Complete REST API reference for threat intelligence. Check domains, IPs, URLs and file hashes, download blocklists, and stream updates. OpenAPI 3.0 spec included.
Yes. The isMalicious API is listed in the Security category of the public-apis directory, which only includes APIs that are free or have a free tier. Check its documentation for rate limits and paid plans.
Yes. The isMalicious API uses apiKey authentication, so you need to register for credentials before making requests.
Not directly. The isMalicious API does not allow CORS, so call it from a server, serverless function or proxy instead of front-end JavaScript.
Yes. The isMalicious API is served over HTTPS, so it's safe to use in production.