Query for any suspicious IP address

[ephrem3232]

I'm looking for a splunk query for any suspicious IP address associated with an IP range that was already blocked in the top ten.

Thank you,

[richgalloway]

Questions to help clarify the problem.
What do you consider a "suspicious IP address"?
If the IP range was already blocked then how will an IP address in that range appear in the top ten?