I've found that the anti-malware reporting ecosystem is very timely in the last few years. These types of exploits usually use a poisoned iframe or similar. I'll occasionally test email links and even after just a matter of a few hours the links are down. The poisoned links might take a bit long to be killed based on the little testing I've done.