diff --git a/sality/sality_c2s_2020_to_2023.txt b/sality/sality_c2s_2020_to_2023.txt
new file mode 100644
index 0000000..63aaae9
--- /dev/null
+++ b/sality/sality_c2s_2020_to_2023.txt
@@ -0,0 +1,8 @@
+# Careful, some of them are sinkholed by ShadowServer. I add them here so ongoing infections can be recognized. Please make sure to check DNS servers for these domains.
+http://kukutrustnet888.info/home.gif
+http://89.119.67.154/testo5/
+http://kukutrustnet777888.info/
+http://kukutrustnet777.info/home.gif
+http://klkjwre77638dfqwieuoi888.info/
+http://www.klkjwre9fqwieluoi.info/
+http://kukutrustnet987.info/home.gif