Threat intelligence: incident clusters, validated IOCs, CVEs, ransomware leak-site victims.
ThreatCluster API is a free Security API that requires apiKey authentication, is served over HTTPS and does not support CORS, so it should be called from a server.
Details from threatcluster.io.

Unified API suite · now live
Geocode an address, validate an email, track a flight or pull stock data with one account, one dashboard and one API key.
Virushee file/data scanning
The ThreatCluster API is provided by ThreatCluster Public API (threatcluster.io).
Yes. The ThreatCluster API is listed in the Security category of the public-apis directory, which only includes APIs that are free or have a free tier. Check its documentation for rate limits and paid plans.
Yes. The ThreatCluster API uses apiKey authentication, so you need to register for credentials before making requests.
Not directly. The ThreatCluster API does not allow CORS, so call it from a server, serverless function or proxy instead of front-end JavaScript.
Yes. The ThreatCluster API is served over HTTPS, so it's safe to use in production.