Sundown is one of the few EKs in the world that have added new exploits in recent months. New exploits have been added to the exploit kit, while some have been dropped. The kit’s original identifiers have been stripped, making it harder to spot. Sundown’s payloads now reside on a different server from the one it uses to host its landing page and exploit pages. The authors of the kit appear to be buying legitimately registered domains in bulk from resellers in an apparent bid to avoid blacklists.”]