CryptCrypt.am (the site used to encrypt the Blackhole exploit kit) is now completely offline, and that’s pretty telling. Blackhole and Cool exploit kits are about a week and a half old at this point. The last date we observed significantly high numbers was on the 9th of October, since then Blackhole prevalence has declined to almost zero. However, Sweet Orange increased drastically shortly after “Paunch”‘s arrest. 98% of compromises were done through Java, according to our desktop antivirus products FireAMP and Immunet.”]
Source: https://blog.talosintelligence.com/2013/10/sweet-orange-exploit-kit-was-new-king.html