RIG, Sundown, Neutrino and Magnitude EK are the most common exploit kits we are seeing in our telemetry and honeypots. Malvertising campaigns keep fuelling redirections to exploit kits as well, but can greatly vary in size and impact. Pseudo-Darkleech and EITest are most popular redirection campaigns from compromised websites. RIG EK remains the most popular exploit kit at the moment used both in malvertising and compromised websites campaigns. Sundown EK keeps on changing its URL patterns, mainly for the Flash exploit and its payload URLs.”]
Source: https://blog.malwarebytes.com/threat-analysis/2017/03/exploit-kits-winter-2017-review/