Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
--- a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/iocs.csv
+++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/iocs.csv
@@ -0,0 +1,126 @@
+uuid,event_id,category,type,value,comment,to_ids,date
+595140b9-6d24-4529-b5cb-06b28e96ca05,104,Network activity,domain,"iusacell-movil.com.mx","",1,20170626
+595140b9-7ac8-4ae1-84ac-06b28e96ca05,104,Network activity,domain,"smscentro.com","",1,20170626
+595140b9-7ed4-48c2-ad5b-06b28e96ca05,104,Network activity,domain,"twiitter.com.mx","",1,20170626
+595140b9-8bf0-466f-a633-06b28e96ca05,104,Network activity,domain,"secure-access10.mx","",1,20170626
+595140b9-a2cc-4642-be72-06b28e96ca05,104,Network activity,domain,"ideas-telcel.com.mx","",1,20170626
+595140b9-bf04-4011-a222-06b28e96ca05,104,Network activity,domain,"smsmensaje.mx","",1,20170626
+595140b9-d344-4943-8ee8-06b28e96ca05,104,Network activity,domain,"unonoticias.net","",1,20170626
+595140b9-ea38-4167-af75-06b28e96ca05,104,Network activity,domain,"mymensaje-sms.com","",1,20170626
+595140b9-fdf8-4877-ae89-06b28e96ca05,104,Network activity,domain,"fb-accounts.com","",1,20170626
+595140b9-fee0-42c2-abc9-06b28e96ca05,104,Network activity,domain,"network190.com","",1,20170626
+595141ad-0754-4b53-a851-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1MAAWrO","",1,20170626
+595141ad-10ec-4896-8197-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JW0JFQ","",1,20170626
+595141ad-1198-4ef7-89ab-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Nz2RZe","",1,20170626
+595141ad-136c-40a3-bf90-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1U0yzVG","",1,20170626
+595141ad-17e0-4953-ae3e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1twXSDl","",1,20170626
+595141ad-1a9c-4657-9043-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1EQYOkG","",1,20170626
+595141ad-1ce8-4723-a8a7-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1KufGUy","",1,20170626
+595141ad-2514-421a-86f7-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Nr0Vpb","",1,20170626
+595141ad-2608-4458-8a3a-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1hMG15k","",1,20170626
+595141ad-3fc4-49a7-a84a-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1TTjm6D","",1,20170626
+595141ad-48bc-4d2b-a43d-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1QbgONr","",1,20170626
+595141ad-4c4c-484b-b316-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1QYVJU9","",1,20170626
+595141ad-4d6c-4191-96dd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1WzrZ8T","",1,20170626
+595141ad-5060-4c84-b0e5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1X9kJRJ","",1,20170626
+595141ad-5dac-47dc-81f3-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1LLY8oK","",1,20170626
+595141ad-752c-4355-a7ca-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1MAzTZ7","",1,20170626
+595141ad-77b0-4fc8-9cb0-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JDkjuX","",1,20170626
+595141ad-7858-4579-a385-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1NlM0ME","",1,20170626
+595141ad-93c0-4169-828c-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1NzkyeZ","",1,20170626
+595141ad-9750-4b3f-822b-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1O77vPb","",1,20170626
+595141ad-d470-4103-b354-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JzfmW1","",1,20170626
+595141ad-e0e8-4d3d-a2f5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Wzryvp","",1,20170626
+595141ad-e484-4c67-bb23-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1LLYT15","",1,20170626
+595141ad-e780-479f-af9e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1SU5N7q","",1,20170626
+595141ad-fca8-4841-b6e5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1KDekJ9","",1,20170626
+595141ad-fe1c-4872-a3fd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1s2eguc","",1,20170626
+595141ae-0cb8-4da3-9788-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1656017s/","",1,20170626
+595141ae-0dbc-485c-9516-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/5957475s/","",1,20170626
+595141ae-191c-4dad-a8df-06b38e96ca05,104,Payload delivery,url,"https://network190.com/8361397s/","",1,20170626
+595141ae-1af0-4d3a-be93-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9371877s/","",1,20170626
+595141ae-215c-4101-bdc5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/235giae","",1,20170626
+595141ae-21ac-41b9-956c-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/2683786s/","",1,20170626
+595141ae-24ec-488e-b0e8-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1239663s/","",1,20170626
+595141ae-2bf8-4f1d-8ed0-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4667624s/","",1,20170626
+595141ae-2e38-4e91-a008-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/292heXd","",1,20170626
+595141ae-3e2c-443b-ad7b-06b38e96ca05,104,Payload delivery,url,"http://mymensaje-sms.com/6649365s/","",1,20170626
+595141ae-4054-47ba-b479-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4878494s/","",1,20170626
+595141ae-420c-4615-b723-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1419678s/","",1,20170626
+595141ae-4944-4ad9-a7af-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/7757294s","",1,20170626
+595141ae-4aa8-4962-986c-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/[unavailable]","",1,20170626
+595141ae-4be8-45c9-b2dc-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29eWzzv","",1,20170626
+595141ae-4dc4-4d20-9726-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/3376811s/","",1,20170626
+595141ae-5650-454d-b04a-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/7831163s/","",1,20170626
+595141ae-593c-49e2-b5e2-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1331744s/","",1,20170626
+595141ae-6aa4-4e7f-a9b3-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9439115s/","",1,20170626
+595141ae-6b6c-4675-b743-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4494681s/","",1,20170626
+595141ae-6cec-4bb8-b0ec-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5840625s/","",1,20170626
+595141ae-7040-450e-97c7-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9093723s/","",1,20170626
+595141ae-738c-4135-aa6c-06b38e96ca05,104,Payload delivery,url,"https://ideas-telcel.com.mx/5706662s","",1,20170626
+595141ae-74b0-4be5-be10-06b38e96ca05,104,Payload delivery,url,"https://network190.com/2066781s/","",1,20170626
+595141ae-7660-4301-91cd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/246doke","",1,20170626
+595141ae-7874-44b6-8638-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/246dkRy","",1,20170626
+595141ae-82a0-4fed-acdc-06b38e96ca05,104,Payload delivery,url,"https://network190.com/6214010s/","",1,20170626
+595141ae-8354-4c49-b7a1-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1z2NQdh","",1,20170626
+595141ae-83d4-45e0-960e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29eWFqz","",1,20170626
+595141ae-8ca4-46f9-8c33-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/2a0hZ2l","",1,20170626
+595141ae-8e00-41c6-825e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Xxf32k","",1,20170626
+595141ae-909c-4d8d-948a-06b38e96ca05,104,Payload delivery,url,"https://fb-accounts.com/2408931s","",1,20170626
+595141ae-929c-4c73-b5ae-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9936510s/","",1,20170626
+595141ae-9418-41e9-aecc-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/8643330s/","",1,20170626
+595141ae-a298-4139-a48b-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1214510s/","",1,20170626
+595141ae-a384-43c4-ae80-06b38e96ca05,104,Payload delivery,url,"http://fb-accounts.com/2069487s/","",1,20170626
+595141ae-b058-4eb5-bb7b-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29lQvyh","",1,20170626
+595141ae-b0cc-46ad-8fda-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/7161504s/","",1,20170626
+595141ae-b384-4fc8-9951-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/3990495s/","",1,20170626
+595141ae-b48c-4a93-9163-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/1930327s","",1,20170626
+595141ae-b69c-4aaf-a217-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6881768s/","",1,20170626
+595141ae-b9e0-4327-aa26-06b38e96ca05,104,Payload delivery,url,"http://smscentro.com/9480260s/","",1,20170626
+595141ae-c494-4b9b-9676-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/20Y9r10","",1,20170626
+595141ae-c9ec-4d6b-aeb1-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1XFaS4F","",1,20170626
+595141ae-cbe0-4757-a1a6-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/4257391s/","",1,20170626
+595141ae-d08c-48ca-bd09-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5478753s/","",1,20170626
+595141ae-d118-4cfe-a0a4-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29LfZfD","",1,20170626
+595141ae-d21c-4e4e-94b8-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/2110126s/","",1,20170626
+595141ae-da5c-42a8-aea5-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5732641s/","",1,20170626
+595141ae-e008-472d-9d03-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6445761s/","",1,20170626
+595141ae-e034-48d6-83cf-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1493024s/","",1,20170626
+595141ae-e150-4ab5-93d5-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1911343s/","",1,20170626
+595141ae-e8f4-4c6b-9571-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/295RmfH","",1,20170626
+595141ae-ea14-4684-adb1-06b38e96ca05,104,Payload delivery,url,"http://iusacell-movil.com.mx/7918310s/","",1,20170626
+595141ae-eba4-4d12-bc80-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/2618844s/","",1,20170626
+595141ae-efbc-487e-ae1a-06b38e96ca05,104,Payload delivery,url,"http://fb-accounts.com/1074139s/","",1,20170626
+595141ae-f220-4bee-9df4-06b38e96ca05,104,Payload delivery,url,"http://iusacell-movil.com.mx/8595070s/","",1,20170626
+595141ae-f250-4615-b9cd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/295RNq7","",1,20170626
+595141ae-f278-41ad-9e79-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/25nmH1O","",1,20170626
+595141ae-f498-4f27-bb20-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/7893029s/","",1,20170626
+595141ae-f4f4-4f6d-9dbe-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6056487s/","",1,20170626
+595141ae-fa1c-4757-8946-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/8435662s/","",1,20170626
+595141ae-fba4-4030-9c61-06b38e96ca05,104,Payload delivery,url,"https://ideas-telcel.com.mx/3975827s","",1,20170626
+595141af-109c-49c0-a621-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/3651023s/","",1,20170626
+595141af-1650-4b7a-a3f3-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/9250302s/","",1,20170626
+595141af-1c0c-40a8-9059-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5723329s/","",1,20170626
+595141af-2dac-4f74-9717-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/9804185s/","",1,20170626
+595141af-2e50-4760-826b-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8592764s/","",1,20170626
+595141af-3c6c-4adf-b195-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5027740s/","",1,20170626
+595141af-4e28-43e0-abb7-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6843502s/","",1,20170626
+595141af-4ed0-493c-abb8-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/5819525s/","",1,20170626
+595141af-545c-45eb-8055-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6809853s/","",1,20170626
+595141af-64c8-4783-8cfc-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8439927s/","",1,20170626
+595141af-6b7c-430b-ac54-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/3423768s/","",1,20170626
+595141af-73d4-45d1-aecd-06b38e96ca05,104,Payload delivery,url,"http://twiitter.com.mx/2857663s/","",1,20170626
+595141af-75cc-4c7e-8e0a-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1867745s/","",1,20170626
+595141af-8adc-48ba-b585-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/1214510s/","",1,20170626
+595141af-8d70-4703-8aab-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/6218095s/","",1,20170626
+595141af-8e20-4a46-bf32-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/4709973s/","",1,20170626
+595141af-a2c8-4f54-af98-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/4392216s/","",1,20170626
+595141af-ae9c-46b6-bd19-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5851721s/","",1,20170626
+595141af-af04-42cd-8891-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/7564969s/","",1,20170626
+595141af-b5e0-4b6e-a4ea-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/7972736s/","",1,20170626
+595141af-d7c4-4ec4-b292-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/9436744s/","",1,20170626
+595141af-dbd4-4aff-9733-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/2046803s/","",1,20170626
+595141af-e238-48f1-8fdf-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6532946s/","",1,20170626
+595141af-e3dc-4232-b605-06b38e96ca05,104,Payload delivery,url,"http://tinyurl.com/j7luz86","",1,20170626
+595141af-f744-4f14-825e-06b38e96ca05,104,Payload delivery,url,"http://tinyurl.com/o2tq8rl","",1,20170626
+595141af-fc1c-407c-a526-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8167459s/","",1,20170626
--- a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/misp.json
+++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/misp.json
--- a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/openioc.ioc
+++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/openioc.ioc
@@ -0,0 +1,513 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="59513ebe-4144-4e2d-8670-06b38e96ca05" last-modified="2017-06-26T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
+  <short_description>Event #104</short_description>
+  <description>Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware</description>
+  <keywords />
+  <authored_by>citizenlab</authored_by>
+  <authored_date>2017-06-26T00:00:00</authored_date>
+  <links />
+  <definition>
+    <Indicator operator="OR" id="59513ebe-4144-4e2d-8670-06b38e96ca05">
+      <IndicatorItem id="ideas-telcel.com.mx" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="iusacell-movil.com.mx" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mymensaje-sms.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="network190.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="secure-access10.mx" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="smscentro.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="smsmensaje.mx" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="twiitter.com.mx" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="unonoticias.net" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="fb-accounts.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1EQYOkG" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1hMG15k" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1JDkjuX" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1JW0JFQ" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1JzfmW1" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1KDekJ9" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1KufGUy" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1LLY8oK" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1LLYT15" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1MAAWrO" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1MAzTZ7" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1NlM0ME" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1Nr0Vpb" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1Nz2RZe" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1NzkyeZ" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1O77vPb" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1QbgONr" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1QYVJU9" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1s2eguc" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1SU5N7q" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1TTjm6D" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1twXSDl" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1U0yzVG" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1Wzryvp" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1WzrZ8T" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1X9kJRJ" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1XFaS4F" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1Xxf32k" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/1z2NQdh" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/20Y9r10" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/235giae" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/246dkRy" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/246doke" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/25nmH1O" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/292heXd" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/295RmfH" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/295RNq7" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/29eWFqz" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/29eWzzv" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/29LfZfD" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/29lQvyh" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://bit.ly/2a0hZ2l" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://fb-accounts.com/1074139s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://fb-accounts.com/2069487s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://ideas-telcel.com.mx/1930327s" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://ideas-telcel.com.mx/2110126s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://ideas-telcel.com.mx/7757294s" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://iusacell-movil.com.mx/7918310s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://iusacell-movil.com.mx/8595070s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://mymensaje-sms.com/6649365s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://fb-accounts.com/2408931s" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://ideas-telcel.com.mx/3975827s" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://ideas-telcel.com.mx/5706662s" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smscentro.com/9480260s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/1239663s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/1331744s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/1493024s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/1656017s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/1911343s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/3376811s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/3990495s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/5957475s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/6056487s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/6445761s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/6881768s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/9093723s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/9371877s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/9439115s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/9936510s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://smsmensaje.mx/[unavailable]" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://network190.com/2066781s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://network190.com/6214010s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://network190.com/8361397s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://secure-access10.mx/2618844s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://secure-access10.mx/4257391s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://secure-access10.mx/7161504s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/2683786s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/4494681s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/4667624s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/4878494s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/5478753s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/5732641s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/5840625s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/7831163s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/7893029s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/8435662s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://smsmensaje.mx/8643330s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/1214510s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/1419678s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/1867745s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/2046803s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/3651023s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/4392216s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/4709973s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/5027740s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/5723329s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/5851721s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/6532946s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/6809853s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/6843502s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/7564969s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/7972736s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/8167459s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/8439927s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/8592764s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="https://unonoticias.net/9436744s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://tinyurl.com/j7luz86" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://tinyurl.com/o2tq8rl" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://twiitter.com.mx/2857663s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://unonoticias.net/1214510s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://unonoticias.net/3423768s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://unonoticias.net/5819525s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://unonoticias.net/6218095s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://unonoticias.net/9250302s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://unonoticias.net/9804185s/" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+    </Indicator>
+  </definition>
+</ioc>
--- a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/stix.xml
+++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/stix.xml