diff --git a/56.md b/56.md
index f7b1b1a94..dc6f09836 100644
--- a/56.md
+++ b/56.md
@@ -22,7 +22,7 @@ are reporting.
 
 If reporting a note, an `e` tag MUST also be included referencing the note id.
 
-A `report type` string MUST be included as the 3rd entry to the `e` or `p` tag
+A `report type` string MUST be included as the 3rd entry to the `e`, `p` or `x` tag
 being reported, which consists of the following report types:
 
 - `nudity` - depictions of nudity, porn, etc.
@@ -33,7 +33,9 @@ being reported, which consists of the following report types:
 - `impersonation` - someone pretending to be someone else
 - `other` - for reports that don't fit in the above categories
 
-Some report tags only make sense for profile reports, such as `impersonation`
+Some report tags only make sense for profile reports, such as `impersonation`.
+
+- `x` tags SHOULD be info hash of a blob which is intended to be report. when the `x` tag is represented client MUST include an `e` tag which is the id of the event that contains the mentioned blob. also, additionally these events can contain a `server` tag to point to media servers which may contain the mentioned media.
 
 `l` and `L` tags MAY be also be used as defined in [NIP-32](32.md) to support
 further qualification and querying.
@@ -45,7 +47,7 @@ Example events
 {
   "kind": 1984,
   "tags": [
-    ["p", <pubkey>, "nudity"],
+    ["p", "<pubkey>", "nudity"],
     ["L", "social.nos.ontology"],
     ["l", "NS-nud", "social.nos.ontology"]
   ],
@@ -58,8 +60,8 @@ Example events
 {
   "kind": 1984,
   "tags": [
-    ["e", <eventId>, "illegal"],
-    ["p", <pubkey>]
+    ["e", "<eventId>", "illegal"],
+    ["p", "<pubkey>"]
   ],
   "content": "He's insulting the king!",
   // other fields...
@@ -70,13 +72,26 @@ Example events
 {
   "kind": 1984,
   "tags": [
-    ["p", <impersonator pubkey>, "impersonation"]
+    ["p", "<impersonator pubkey>", "impersonation"]
   ],
   "content": "Profile is impersonating nostr:<victim bech32 pubkey>",
   // other fields...
 }
 ```
 
+```jsonc
+{
+  "kind": 1984,
+  "tags": [
+    ["x", "<blob hash>", "malware"],
+    ["e", "<event id which contains the blob on x tag>", "malware"],
+    ["server", "https://you-may-find-the-blob-here.com/path-to-url.ext"]
+  ],
+  "content": "This file contains malware software in it.",
+  // other fields...
+}
+```
+
 Client behavior
 ---------------