The folks at http://getipintel.net/ can give you some decent information about wether an IP looks spammy or not.
> Given an IP address, the system will return a probabilistic value (between a value of 0 and 1) of how likely the IP is a VPN / proxy / hosting / bad IP. A value of 1 means that IP is explicitly banned (a web host, VPN, or TOR node) by our dynamic lists.
We've been using it for a while and are pretty happy.
If you want to know whether an IP is from a VPN, Tor or a compromised server you can do that for free using the Shodan API (https://developer.shodan.io).
Disclaimer: I'm the founder of Shodan and identifying the type of connection is something we're often used for.
You can see all the datapoints we provide by visiting our homepage https://ipdata.co or by making a call in your terminal via curl https://api.ipdata.co
Thank you for sharing your need for this. I'm going to make this a priority. If you'd send me an email jonathan at ipdata dot co, just a quick hello, I could keep you up to date on our progress as we develop this.