FUNNULL Scam Network Resurfaces With 175+ Rotating Domains Worldwide

FUNNULL-Linked Triad Nexus has quietly rebuilt its scam infrastructure, now rotating through more than 175 CNAME domains to keep a sprawling global fraud and brand‑impersonation network online.

Following U.S. Treasury sanctions in May 2025 against FUNNULL Technology Inc., a core infrastructure provider behind the group, Triad Nexus has shifted to more mature operational security while continuing to drive high-value “pig‑butchering” and virtual currency scams.

Despite the 2025 OFAC action that named FUNNULL Technology and administrator Liu Lizhi, the operation has reconstituted its global fraud engine rather than shutting down.

SilentPush research links Triad Nexus to over $ 200 million in reported victim losses, with average individual losses around $ 150,000, largely tied to long‑running crypto investment fraud.

Analysts now observe the group refocusing on emerging markets while still probing Western enterprises for high‑value victims and infrastructure footholds.

Infrastructure Laundering at Scale

Triad Nexus originated around the FUNNULL CDN, a content delivery infrastructure used since at least 2020 to host investment scams, illegal gambling, and high‑volume phishing portals.

Instead of using obviously malicious servers, the group engages in “infrastructure laundering,” abusing stolen or fraudulently obtained accounts at major cloud providers to give its sites a veneer of legitimacy and performance.

Research shows persistent use of AS152194 (CTG Server Limited) as a backbone, while segmenting activity across ASNs tied to Amazon, Cloudflare, Google, and Microsoft to frustrate takedown and mapping efforts.

At the application layer, Triad Nexus has industrialized brand theft, operating “pixel‑perfect” clones across banking, retail, and logistics sectors.

SilentPush links the network to a majority of virtual‑currency investment scam sites reported to U.S. authorities, with templates impersonating major payment and transfer services.

Long‑lived client domains like alicdn9858[.]com show years of CNAME rotation, moving from clearly branded FUNNULL hostnames to neutral or deceptive labels such as kanejwo[.]com, cdn899[.]com, and smaooe[.]com.

Active campaigns imitate luxury brands such as Tiffany, Cartier, and Chanel, financial and remittance platforms, and even public services like TripAdvisor and the Vietnam Post to harvest credentials, PII, and funds.

To evade post‑sanctions scrutiny, many Triad Nexus portals now present a “451 Unavailable for Legal Reasons” message to U.S. IPs, effectively geofencing investigators while continuing operations elsewhere.

The syndicate has pivoted aggressively into Spanish, Vietnamese, and Indonesian‑language campaigns, using localized lures to sustain revenue streams outside direct U.S. oversight.

In parallel, it has rolled out “clean” CDN‑style front companies such as Bole CDN, CDN1.ai, and other brands that advertise professional cloud or CDN services while quietly feeding traffic into the laundered FUNNULL ecosystem.

175+ Rotating CNAME Chains

Where earlier versions of the infrastructure relied on a small, stable set of FUNNULL‑branded CNAMEs, the rebuilt network now cycles through more than 175 randomly generated CNAME domains that sit between victim‑facing sites and final IP addresses.

These CNAMEs are repeatedly mapped to IPs at large cloud providers, then torn down and remapped, creating fast‑moving clusters of fake casinos, adult content, and investment portals aimed primarily at Chinese‑speaking users.

This rapid CNAME churn breaks many traditional investigative workflows that only resolve a single DNS hop at a time.

To counter that, SilentPush has introduced a CNAME Chain Lookup capability that automatically walks the full redirection path from a client domain, through multiple intermediary CNAMEs, to the ultimate A records and associated ASNs.

By turning opaque chains like “client → CNAME1 → CNAME2 → laundered IP” into a single, queryable view, the tool gives defenders a way to spot shared infrastructure, segment campaigns, and implement near real‑time blocking at the DNS and IP layers.

For security teams, the Triad Nexus resurgence underscores that reactive, indicator‑only defenses will lag behind an adversary willing to rotate front domains, CNAMEs, and cloud accounts continuously.

Preemptive monitoring of CNAME chains, infrastructure‑laundering patterns, and suspicious “clean” CDN brands is now essential to protecting both enterprise brands and end users from this rebuilt FUNNULL‑linked fraud machine.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.