Honeypots and sensornets; telemetry from consumer and enterprise devices.

Checkpoint is a firewall vendor; the devices have considerable visibility of public IPv4 traffic and can report back to the vendor when various Intrusion Detection and Prevention rules are hit.

Other vendors are doing traffic analysis in cloud, so the vendor has an out of band view of malicious traffic flows.