diff --git a/README.md b/README.md
index edb4bc5ba..59e44a3e7 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ It installs as its **own binary** with its **own config directory**, so it runs
 ## What's different from subfinder
 
 ### Faster by default
-- **Curated fast sources are the default.** A run uses seven fast, keyless sources (`thc`, `submd`, `crt`, `shodanct`, `rapiddns`, `hackertarget`, `sitedossier`) instead of every source. Use `-all` for the full set, or `-fast=false` for subfinder's original default selection.
+- **Curated fast sources are the default.** A run uses eight fast, keyless sources (`thc`, `submd`, `crt`, `scanmalware`, `shodanct`, `rapiddns`, `hackertarget`, `sitedossier`) instead of every source. Use `-all` for the full set, or `-fast=false` for subfinder's original default selection.
 - **HTTP keep-alive.** Connections are reused instead of a fresh TCP+TLS handshake per request. Sources that paginate heavily (e.g. `thc`) drop from ~32s to ~11s on large domains.
 - **Update check is off by default.** subfinder makes a blocking network call to its update registry on every startup (~1s). subfaster skips it, so startup is ~30ms. Re-enable with `-duc=false`.
 - **Lower default timeout** (10s, was 30s) and **Cloudflare-only resolvers** (`1.1.1.1`, `1.0.0.1`) for `-active`, instead of a long list that includes slow resolvers.
diff --git a/pkg/runner/initialize.go b/pkg/runner/initialize.go
index 494ba5928..b50d4c0e8 100644
--- a/pkg/runner/initialize.go
+++ b/pkg/runner/initialize.go
@@ -10,7 +10,7 @@ import (
 )
 
 // FastSources is the curated set of fast, productive keyless sources used by -fast.
-var FastSources = []string{"thc", "submd", "crt", "shodanct", "rapiddns", "hackertarget", "sitedossier"}
+var FastSources = []string{"thc", "submd", "crt", "scanmalware", "shodanct", "rapiddns", "hackertarget", "sitedossier"}
 
 // initializePassiveEngine creates the passive engine and loads sources etc
 func (r *Runner) initializePassiveEngine() {