AbuseIPDB

Tells you whether an IP is mass-scanning the internet or belongs to a benign service (search engines, researchers), so you can separate background noise from targeted activity.

Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.

LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.

Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.

Threat-focused internet asset search engine with IP and domain risk scoring, exposed services, vulnerabilities and screenshot reports.

Reputation API for email addresses that reports age, breach exposure, social profiles, disposable/free provider status, and suspicious activity flags.