From b7e8918193b7aef0f372b2909b8fbfe2957c5574 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Wed, 14 Feb 2018 11:10:44 +0100
Subject: [PATCH] fix: JSON format

---
 clusters/exploit-kit.json | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/clusters/exploit-kit.json b/clusters/exploit-kit.json
index 08dcd61..520a706 100644
--- a/clusters/exploit-kit.json
+++ b/clusters/exploit-kit.json
@@ -505,17 +505,21 @@
         "status": "Retired - Last seen: 2013-09"
       }
     },
-	{
-		"value": "SPL",
-		"description": "SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV",
-		"meta": {
-			"refs": ["http://www.malwaresigs.com/2012/12/05/spl-exploit-kit/"],
-			"status": "Retired - Last seen: 2015-04",
-			"synonyms": ["SPL_Data",
-			"SPLNet",
-			"SPL2"],
-		}
-	},
+    {
+      "value": "SPL",
+      "description": "SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV",
+      "meta": {
+        "refs": [
+          "http://www.malwaresigs.com/2012/12/05/spl-exploit-kit/"
+        ],
+        "status": "Retired - Last seen: 2015-04",
+        "synonyms": [
+          "SPL_Data",
+          "SPLNet",
+          "SPL2"
+        ]
+      }
+    },
     {
       "value": "Sundown",
       "description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",