# WhiteMagic Citadel community blocklist (nftables)
# Generated 2026-11-06T15:30:02+00:00; 170 addresses; source https://api.whitemagic.dev/iocs/
# Listed = acted inside a decoy on ONE sensor (see latest.json). Shared, NAT'd or
# reassigned addresses can be listed, and benign research scanners may be listed.
# Elements expire after 24h by design: re-import regularly; do not treat as permanent.
# Review before applying. Apply: nft -f nftables-set.nft   Remove: nft delete table inet wm_community_blocklist
table inet wm_community_blocklist
delete table inet wm_community_blocklist
table inet wm_community_blocklist {
	set banned4 {
		type ipv4_addr
		flags timeout
		timeout 24h
		elements = { 1.247.245.61, 103.163.44.10, 110.77.137.236, 110.84.76.148, 111.56.30.30, 111.62.173.90, 111.70.32.179, 112.186.241.118, 113.158.205.225, 113.25.249.100, 116.230.66.189, 116.232.100.225, 118.31.76.150, 118.36.222.243, 119.204.122.94, 120.48.124.164, 121.10.215.142, 121.129.7.154, 121.178.185.141, 121.189.226.81, 121.202.138.181, 121.242.112.205, 122.168.197.245, 124.133.10.66, 124.239.129.2, 124.67.120.106, 125.130.102.172, 125.139.124.120, 125.23.228.86, 125.72.150.250, 128.254.190.160, 131.108.162.24, 135.236.24.217, 138.118.213.68, 139.199.80.137, 14.102.50.87, 14.51.12.142, 14.97.77.182, 147.15.110.51, 152.52.240.162, 155.4.31.215, 157.122.242.217, 163.223.244.3, 165.227.129.203, 171.211.84.116, 173.18.106.54, 175.115.29.122, 175.198.18.3, 176.103.15.195, 176.53.159.196, 177.159.150.111, 177.174.89.99, 178.178.194.135, 178.178.222.55, 178.178.222.57, 179.83.134.101, 180.100.212.177, 180.94.74.2, 180.94.75.42, 181.52.113.102, 182.64.235.185, 182.75.197.174, 182.76.71.82, 183.167.234.154, 183.239.20.236, 183.247.171.186, 183.56.179.201, 186.80.230.116, 188.219.104.210, 190.223.36.108, 195.123.212.48, 195.158.14.232, 195.252.61.93, 197.156.113.122, 2.184.61.196, 200.199.32.174, 200.222.71.218, 200.223.196.90, 200.232.114.71, 201.28.237.90, 201.46.124.0, 210.206.24.237, 210.95.231.219, 211.226.103.20, 211.248.197.36, 213.101.138.172, 217.208.90.253, 218.15.224.102, 218.202.143.68, 218.202.91.147, 218.219.193.151, 218.4.110.186, 218.92.251.198, 219.129.96.2, 219.248.4.146, 220.154.134.180, 220.161.52.149, 220.165.85.39, 220.182.14.60, 220.78.182.74, 220.78.85.92, 223.107.72.234, 23.242.245.150, 24.211.86.244, 24.47.192.100, 27.107.102.154, 27.115.113.138, 27.123.107.154, 27.24.141.156, 31.173.0.140, 31.173.31.59, 31.173.69.14, 36.133.118.53, 36.153.164.122, 36.249.60.142, 37.113.113.77, 37.157.91.62, 38.141.252.55, 39.153.168.211, 39.164.91.67, 41.219.149.78, 45.170.50.2, 45.238.2.93, 45.55.133.80, 46.129.12.30, 46.210.94.61, 46.59.91.85, 49.115.219.90, 49.124.149.214, 50.187.155.130, 50.25.65.7, 50.82.130.170, 58.22.255.28, 58.245.210.70, 58.250.117.205, 58.51.132.251, 59.13.72.226, 59.46.182.10, 59.8.52.172, 59.8.66.225, 60.172.1.210, 60.223.245.120, 61.145.181.7, 61.146.129.133, 61.160.12.210, 63.65.203.83, 65.20.131.212, 65.20.202.4, 65.20.216.133, 70.166.140.221, 70.169.11.150, 70.169.11.216, 70.183.232.211, 70.91.135.181, 72.215.33.52, 74.208.177.56, 77.90.185.29, 78.66.44.61, 80.94.95.118, 83.191.181.23, 83.209.248.110, 83.209.250.100, 84.199.12.218, 85.234.8.116, 89.160.102.76, 89.160.34.69, 92.251.124.73, 93.95.241.150, 94.255.255.26, 95.97.25.198 }
	}
	set banned6 {
		type ipv6_addr
		flags timeout
		timeout 24h
	}
	chain input {
		type filter hook input priority -10; policy accept;
		ip saddr @banned4 tcp dport { 80, 443 } drop
		ip6 saddr @banned6 tcp dport { 80, 443 } drop
	}
}