CINS (Collective Intelligence Network Security), can identify several classes of “bad” IP addresses.

CINS is a network of “sentinel” hosts running around the internet that allow a company to monitor attacks leveraged against them and score them appropriately.

Rulesets:

• emerging-botcc.portgrouped.rules
• emerging-botcc.rules emerging-ciarmy.rules
• emerging-exploit.rules emerging-malware.rules
• emerging-mobile_malware.rules
• emerging-shellcode.rules
• emerging-trojan.rules
• emerging-web_server.rules
• emerging-web_specific_apps.rules
• emerging-worm.rules

https://cinsarmy.com/active-threat-intelligence/