Reput.io lookups now flag known-bad infrastructure, not just known-good. Indicators on threat intel lists come back with a "threat" status and a malicious or suspicious verdict, on every plan including Free.
One rule we didn't bend: shared infrastructure like a CDN edge never comes back "malicious". The feed caught one tenant, not the edge.
https://www.reput.io/blog/threat-intelligence-in-every-lookup