diff --git a/nazar/README.MD b/nazar/README.MD
new file mode 100644
index 0000000..02118d8
--- /dev/null
+++ b/nazar/README.MD
@@ -0,0 +1,6 @@
+related:
+https://research.checkpoint.com/2020/nazar-spirits-of-the-past/
+
+https://www.epicturla.com/blog/the-lost-nazar
+
+https://blog.malwarelab.pl/posts/nazar_eyservice/