diff --git a/README.md b/README.md
index 09142fb..8e4bd75 100644
--- a/README.md
+++ b/README.md
@@ -192,7 +192,17 @@ A certain amount of (domain- or business-specific) analysis is necessary to crea
Ransomware Tracker
|
- The Ransomware Tracker by abuse.ch tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites.
+ The Ransomware Tracker by abuse.ch tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C∓C servers, distribution sites and payment sites.
+ |
+
+
+ |
+ SANS ICS Suspicious Domains
+ |
+
+ The Suspicious Domains Threat Lists by SANS ICS tracks suspicious domains. It offers 3 lists categorized as either high, medium or low sensitivity, where the high sensitivity list has fewer false positives, whereas the low sensitivty list with more false positives. There is also an approved whitelist of domains.
+ Finally, there is a suggested IP blocklist from DShield.
+
|
@@ -973,7 +983,7 @@ All kinds of tools for parsing, creating and editing Threat Intelligence. Mostly
|
- yeti/a>
+ yeti
|
Your Everyday Threat Intelligence (YETI).
|