Java.

The Java applet is accessible. The trojan using the URL for the Java exploit is accessible.

The Java applet I get comes back under the headers:

Content-Type: text/html
Content-Encoding: pack200-gzip

so don't expect to see java content headers.

The applet is being updated.

Until quite recently one could find the Java code to download, decodeand run the trojan. The decoding was a simple looping XOR AND THE MODIFICATION OF ONE BYTE IN THE PE HEADER.

A few days ago that changed. There is no Java code to download, decode or run the applet. There is encrypted shell code. The URL for the trojan, the decoding key and a filename for saving (and then running) the payload is inserted into the shell code. The shell code is used to download, decode and run the payload.

The decoding is now only a simple looping XOR (was it too bothersome to encode the adjustment of one PE header byte in the shell code?).

I don't run windows so I use a script to get the applet
(the javascript shows that only if a Java exploit is avaiable AND there is no Flash or Silverlight exploit available will the Java exploit be triggered so it seems to be a fallback).

If you were simply checking content type headers, or even content (looking for a zipped/jar file or class file but not for Oracle's pack200 format) you may have missed cases where the Java exploit was triggered.
Perhaps I missed something in the exploit page, but the applet is being (has just been) updated.