diff --git a/Scoring Engine/config.py b/Scoring Engine/config.py
index 77243f7..ec7b791 100644
--- a/Scoring Engine/config.py	
+++ b/Scoring Engine/config.py	
@@ -70,3 +70,17 @@
     "support","tel", "to", "today", "top", "tr", "tv", "ua",
     "us", "vip", "wiki", "world", "ws", "xn--q9jyb4c", "xyz"
 ]
+
+MAL_REGISTRARS = [
+    "StanCo", "Istanco", "Hangzhou Yunji", "FlokiNET", "NauNet", "OPENPROV-RU", "DomainDelights", "Navicosoft Pty", "Shock Hosting",
+    "nicenic.net", "DropCatch.com 1422",  "Dynu Systems Incorporated", "RegRU", "Hello Internet Corp", "PortlandNames.com", "Dynadot",
+    "Sav.com", "Gname", "WebNic.cc", "Mat Bao Corporation", "Immaterialism Limited", "MAXNAME-RU", "FE-RU", "温州市中网计算机技术服务有限公司",
+    "Namecheap", "Registrar R01.ru", "SPRINTNAMES-RU", "RegRU", "NIC.UA", "Namecheap", "NameSilo", "WebNic.cc", "Name SRS AB", "XServer",
+    "PDR", "OwnRegistrar", "Trunkoz", "Hostinger", "GMO", "Tucows", "Sav.com", "Realtime Register", "RU-Center", "Name.com", "Openprovider",
+    "Dominet", "GoDaddy", "Ultahost", "WebNic.cc", "河北识道网络科技有限公司", "MainReg Inc.", "Todaynic", "Eranet International" "长春市智绘网络科技有限公司",
+    "厦门三五互联信息有限公司", "南昌知乐远科技有限公司", "长沙小豆网络科技有限公司", "西部数码国际有限公司", "GKG NET", "成都垦派科技有限公司",
+    "四川域趣网络科技有限公司", "海口智慧康网络科技有限公司", "Global Domain Group", "Beijing Dongfang Ruipeng Digital Information Technology Co.",
+    "武汉物与伦比科技有限公司", "厦门纳网科技股份有限公司", "成都西维数码科技有限公司", "west263.com", "rocket"
+]
+
+
diff --git a/Scoring Engine/scoring_logic.py b/Scoring Engine/scoring_logic.py
index 82bfaaa..f6e9572 100644
--- a/Scoring Engine/scoring_logic.py	
+++ b/Scoring Engine/scoring_logic.py	
@@ -541,7 +541,21 @@ def score_whois_pattern(rdap_data:dict, scan_date: datetime, scores:dict): #TODO
     if app_config.VERBOSE:
         print("WHO_IS Score: Registrar name is ", registrar_name, file=sys.stderr)
 
-    #TODO: put registrar scoring here
+    # 2. Check for registrary matches from MAL_REGISTRARS list (case-insensitive substring match)
+    found_matches = False
+    for reg in app_config.MAL_REGISTRARS:
+        # We convert BOTH to lowercase to ensure "NameSilo" matches "namesilo"
+        if reg.lower() in registrar_name.lower():
+            found_matches = True
+            break
+
+    if found_matches:
+        scores['WHOIS_Pattern'] -= 10
+        if app_config.VERBOSE:
+            print("WHO_IS Score: Suspicious Registrar found: ", registrar_name, file=sys.stderr)
+    else:
+        if app_config.VERBOSE:
+            print("WHO_IS Score: Trustworthy Registrar found: ", registrar_name, file=sys.stderr)
 
 def calculate_final_score(weights, scores): #CHANGE
     """