A Brief Gumblar Infrastructure Analysis

This report describes an active malicious infrastructure associated with the Gumblar botnet: compromised sites served obfuscated JavaScript and malicious PDFs that fetched payloads from fast-flux domains (multiple IPs and short TTLs) and C2 endpoints. Analysis identified shared name servers (hostdnssite.com / OnlineNIC), numerous related domains and IPs, low AV detection on the malicious PDF, and exploitation of PDF vulnerabilities (CVE-2008-2992, CVE-2009-0927), indicating a sustained multi-domain campaign supporting multiple malware families.