diff --git a/2024-11-04-IOCs-for-cash-and-loan-scam.txt b/2024-11-04-IOCs-for-cash-and-loan-scam.txt
index 9314081..4898afc 100644
--- a/2024-11-04-IOCs-for-cash-and-loan-scam.txt
+++ b/2024-11-04-IOCs-for-cash-and-loan-scam.txt
@@ -4,6 +4,11 @@ AUTHORS:
 
 - Keerthiraj Nagaraj, Shehroze Farooqi, Nabeel Mohamed, Alex Starov
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_phishing-scam-dropcaught-activity-7260314072762507264-wEEX/
+- https://x.com/Unit42_Intel/status/1854550444778881160
+
 NOTES:
 
 - We recently identified 32 malicious domains on suspicious infrastructure for a loan lending scam.
@@ -51,4 +56,4 @@ DROPCAUGHT DOMAINS SHARING HOSTING IP ADDRESS WITH ABOVE NEWLY REGISTERED DOMAIN
 - 56loan[.]com - re-registered 2024-10-25
 - 69loan[.]com - re-registered 2024-10-25
 - 76loan[.]com - re-registered 2024-10-25
-- 90loan[.]com - re-registered 2024-10-25
\ No newline at end of file
+- 90loan[.]com - re-registered 2024-10-25