I am starting to wonder if by using the REST-API can a feed list be created without the AFM module. I may try in the future but if someone has tested this they can share if it works.
https://clouddocs.f5.com/api/icontrol-rest/APIRef_tm_security_ip-intelligence_info.html
Another way could be to use the CVS tabular imported that I am using for importing a list of bad IP addresses or using external data group and populating it or using ansible or BIG-IQ with external data groups:
https://devcentral.f5.com/s/articles/csv-tabular-data-sideband-importer
https://devcentral.f5.com/s/articles/populating-tables-with-csv-data-via-sideband-connections
https://devcentral.f5.com/s/question/0D51T00006aFjFFSA0/managing-datagroups-from-bigiq
There are some free lists from free or payed providers with palo alto minemeld or misp free systems.