Because people run crawlers and perform illegal activity, and/or because ‘security companies’ sell the IP lists as low reputation potentially malicious IPs?