{
  "_comment": "URLs that return one CIDR or IP per line. Lines starting with # are ignored. Each is fetched nightly into static/bans.txt.",
  "sources": [
    {
      "name": "israel-ipdeny",
      "url": "https://www.ipdeny.com/ipblocks/data/aggregated/il-aggregated.zone",
      "format": "cidr-only",
      "comment": "Israeli IP ranges via ipdeny.com — primary block for political/regional threats"
    },
    {
      "name": "russia-ipdeny",
      "url": "https://www.ipdeny.com/ipblocks/data/aggregated/ru-aggregated.zone",
      "format": "cidr-only",
      "comment": "Russian IP ranges — add when needed; comment out to disable"
    },
    {
      "name": "china-ipdeny",
      "url": "https://www.ipdeny.com/ipblocks/data/aggregated/cn-aggregated.zone",
      "format": "cidr-only",
      "comment": "Chinese IP ranges — uncomment to enable"
    },
    {
      "name": "firehol-level1",
      "url": "https://iplists.firehol.org/files/firehol_level1.netset",
      "format": "cidr-or-ip",
      "comment": "Firehol Level 1 — high-confidence attackers (updated daily)"
    }
  ]
}