The U.S. Treasury Department has imposed sanctions on Funnull Technology, a Philippines-based company responsible for supporting hundreds of thousands of malicious websites linked to cyber scams that have cost Americans over $200 million in losses.
Funnull’s business model involved purchasing bulk IP addresses from cloud service providers and selling them, along with hosting services, to cybercriminals operating “pig butchering” scams. These sophisticated fraud schemes involve criminals contacting victims through dating sites, social media, and messaging apps to build trust before luring them into fraudulent investment opportunities where victims’ funds are diverted to criminal-controlled accounts.
The company employed several technical methods to support these operations, including:
– Domain generation algorithms (DGAs) to create numerous unique domain names
– Web design templates that impersonate trusted brands
– Rapid IP address and domain switching capabilities to evade takedown attempts
“Funnull is linked to the majority of virtual currency investment scam websites reported to the FBI,” stated the Treasury’s Office of Foreign Assets Control (OFAC). “U.S.-based victims of these scam websites have reported over $200 million in losses, with average losses of over $150,000 per individual.”
The sanctions also target Liu Lizhi, a Chinese national who served as Funnull’s administrator and managed the company’s employees. Following these sanctions, U.S. citizens and organizations are prohibited from conducting transactions with Funnull and Lizhi, and all their U.S. assets will be frozen.
The FBI has published technical details about Funnull’s infrastructure, revealing they identified 548 unique Funnull Canonical Names linked to over 332,000 unique domains. The agency noted multiple patterns of IP address activity where “hundreds of domains using Funnull infrastructure simultaneously migrated from one IP address to another either on the same exact day or within the same timeframe.”
This action comes as the FBI recently reported Americans lost a record $16.6 billion to cybercriminals in 2024, with over $6.5 billion specifically lost to investment scams—a 33% increase from the previous year.