If you can automate the treadmill and set a timeout at which point the 'bad' IPs will go back to being 'not necessarily bad', then you're minimising the effort required.

An open project that classifies and records this - would need a fair bit of on-going protection, ironically.