diff --git a/clusters/exploit-kit.json b/clusters/exploit-kit.json
index 08dcd61..520a706 100644
--- a/clusters/exploit-kit.json
+++ b/clusters/exploit-kit.json
@@ -505,17 +505,21 @@
         "status": "Retired - Last seen: 2013-09"
       }
     },
-	{
-		"value": "SPL",
-		"description": "SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV",
-		"meta": {
-			"refs": ["http://www.malwaresigs.com/2012/12/05/spl-exploit-kit/"],
-			"status": "Retired - Last seen: 2015-04",
-			"synonyms": ["SPL_Data",
-			"SPLNet",
-			"SPL2"],
-		}
-	},
+    {
+      "value": "SPL",
+      "description": "SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV",
+      "meta": {
+        "refs": [
+          "http://www.malwaresigs.com/2012/12/05/spl-exploit-kit/"
+        ],
+        "status": "Retired - Last seen: 2015-04",
+        "synonyms": [
+          "SPL_Data",
+          "SPLNet",
+          "SPL2"
+        ]
+      }
+    },
     {
       "value": "Sundown",
       "description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",