CINS (Collective Intelligence Network Security), can identify several classes of “bad” IP addresses.
CINS is a network of “sentinel” hosts running around the internet that allow a company to monitor attacks leveraged against them and score them appropriately.
Rulesets:
emerging-botcc.portgrouped.rules
emerging-botcc.rules emerging-ciarmy.rules
emerging-exploit.rules emerging-malware.rules
emerging-mobile_malware.rules
emerging-shellcode.rules
emerging-trojan.rules
emerging-web_server.rules
emerging-web_specific_apps.rules
emerging-worm.rules