Tracking the Triad Nexus

The talk opens with the 2024 Polyfill.io supply chain attack, in which a widely embedded JavaScript domain redirected some mobile visitors to low-quality casino sites. The domain's new owner was Funnel, a China-linked content delivery network tied to gambling businesses. Revisiting a 2022 pig-butchering investigation, the research team found sites from that campaign still live two years later, suggesting takedown complaints had failed.

The middle of the talk explains how the network hides itself. Funnel chains CNAME records, changes its alias domains over time, and resolves them to pools of IP addresses spread across many autonomous systems, including blocks leased from major Western hosts. A shared error page helped map the footprint. Clustering casino sites by scripts, page titles, favicons and a referenced code repository suggested one developer built many fake brand sites. Linked Telegram channels and money-movement language pointed to a wider laundering scheme, and one CNAME served only retail phishing and investment scams.

The speaker closes with open questions about the financial impact, why gambling sites stayed online while misusing brand names, and who ultimately controls the network. For practitioners, the takeaway is that blocking an entire cloud range can cause collateral damage, so tracking the naming and DNS layers matters as much as individual IPs.