diff --git a/clusters/exploit-kit.json b/clusters/exploit-kit.json
index 096ec1ab..af3f0c8a 100755
--- a/clusters/exploit-kit.json
+++ b/clusters/exploit-kit.json
@@ -15,14 +15,15 @@
        }
     }
 ,
-    { "value": "Blaze EK",
-      "description": "Blaze EK is a rebranding of Terror EK built on Hunter EK code",
+    { "value": "Terror EK",
+      "description": "Terror EK is a rebranding of Terror EK built on Hunter EK code",
       "meta": {
         "refs": [
           "https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"
         ],
        "synonyms": [
-          "Terror EK"
+          "Blaze EK",
+	  "Neptune EK"
         ]
 	   ,
 		"status": "Active"
@@ -111,16 +112,6 @@
 		"status": "Active"
        }
     }
-,
-    { "value": "Nebula",
-      "description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
-      "meta": {
-        "refs": [
-          "http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
-        ],
-		"status": "Active"
-       }
-    }
 ,
     { "value": "Neutrino",
       "description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from  march 2014 till november 2014.",
@@ -179,7 +170,7 @@
         "synonyms": [
           "Sundown-b"
         ],
-        "status": "Active"
+        "status": "Retired"
       }
     },
     {
@@ -195,23 +186,6 @@
         "status": "Active"
       }
     },
-    {
-      "value": "Sundown",
-      "description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
-      "meta": {
-        "refs": [
-          "http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
-          "https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
-        ],
-        "synonyms": [
-          "Beps",
-          "Xer",
-		  "Beta"
-        ],
-        "status": "Active",
-        "colour": "#C03701"
-      }
-    },
     {
       "value": "Angler",
       "description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
@@ -410,6 +384,16 @@
         "status": "Unknown - Last seen: 2014-03"
       }
     },
+    { "value": "Nebula",
+      "description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
+      "meta": {
+        "refs": [
+          "http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
+        ],
+		"status": "Retired - Last seen 2017-03-09"
+       }
+    }
+	  ,
     {
       "value": "Niteris",
       "description": "Niteris was used mainly to target Russian.",
@@ -489,7 +473,27 @@
         ],
         "status": "Retired - Last seen: 2013-09"
       }
-    },
+    }
+	  ,
+    {
+      "value": "Sundown",
+      "description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
+      "meta": {
+        "refs": [
+          "http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
+          "https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
+        ],
+        "synonyms": [
+          "Beps",
+          "Xer",
+	  "Beta"
+        ],
+        "status": "Retired - Last seen 2017-03-08",
+        "colour": "#C03701"
+      }
+    }
+	  
+	  ,
     {
       "value": "Sweet-Orange",
       "description": "Sweet Orange",