diff --git a/etc/unbound/unbound.conf.d/nordvpn-domains.conf b/etc/unbound/unbound.conf.d/nordvpn-domains.conf
index 151b203a..5407e5fa 100644
--- a/etc/unbound/unbound.conf.d/nordvpn-domains.conf
+++ b/etc/unbound/unbound.conf.d/nordvpn-domains.conf
@@ -3,6 +3,7 @@ server:
 # https://docs.quad9.net/Quad9_For_Organizations/DNS_Forwarder_Best_Practices/#disable-qname-minimization
 qname-minimisation: no
 
+# The app needs this, also SOCKS https://support.nordvpn.com/hc/en-us/articles/20195967385745-NordVPN-proxy-setup-for-qBittorrent
 forward-zone:
 	name: "nordhold.net."
 	forward-tls-upstream: no
@@ -11,6 +12,7 @@ forward-zone:
 	forward-addr: 103.86.96.100
 	forward-addr: 103.86.99.100
 
+# Main homepage
 forward-zone:
 	name: "nordvpn.com."
 	forward-tls-upstream: no
@@ -19,6 +21,7 @@ forward-zone:
 	forward-addr: 103.86.96.100
 	forward-addr: 103.86.99.100
 
+# Seen in NoScript on their homepage
 forward-zone:
 	name: "nordcdn.com."
 	forward-tls-upstream: no
@@ -27,8 +30,27 @@ forward-zone:
 	forward-addr: 103.86.96.100
 	forward-addr: 103.86.99.100
 
+# Listed in documentation, https://support.nordvpn.com/hc/en-us/articles/19685519701905-NordVPN-imitation-scams
 forward-zone:
-	name: "nordvpn.com."
+	name: "nordvpn.org."
+	forward-tls-upstream: no
+	forward-addr: 2400:bb40:4444::103
+	forward-addr: 2400:bb40:8888::103
+	forward-addr: 103.86.96.100
+	forward-addr: 103.86.99.100
+
+# Listed in documentation, https://support.nordvpn.com/hc/en-us/articles/19685519701905-NordVPN-imitation-scams
+forward-zone:
+	name: "nordvpnmedia.com."
+	forward-tls-upstream: no
+	forward-addr: 2400:bb40:4444::103
+	forward-addr: 2400:bb40:8888::103
+	forward-addr: 103.86.96.100
+	forward-addr: 103.86.99.100
+
+# Listed in documentation, https://support.nordvpn.com/hc/en-us/articles/19685519701905-NordVPN-imitation-scams
+forward-zone:
+	name: "nordsec.com."
 	forward-tls-upstream: no
 	forward-addr: 2400:bb40:4444::103
 	forward-addr: 2400:bb40:8888::103