FUNNULL-Linked Triad Nexus Returns With 175+ Rotating CNAME Domains

Silent Push researchers report that the Triad Nexus scam syndicate (linked to FUNNULL) has rebuilt at scale using more than 175 rapidly rotating, randomly generated CNAME domains and multi-hop DNS chains to launder infrastructure and evade takedowns; the campaign has been tied to over $200M in reported victim losses and targets both emerging markets and Western consumers. The analysis highlights exploitation of cloud providers and specific ASNs, the limits of single‑hop reactive defenses, and the release of a CNAME Chain Lookup tool to map and disrupt the network.