Infoblox has uncovered more than 236,000 websites running investment scam templates built with DCloud Uni-App, a legitimate Chinese open-source cross-platform development framework. The scale is staggering — 236,493 distinct second-level domains powering fake crypto exchanges, pig-butchering operations, WhatsApp phishing networks, rigged gambling platforms, brand-impersonation sites, and crypto wallet drainers.
These arent small-time operations. Among the identified domains is RainbowEx, a bogus cryptocurrency exchange that ran a Ponzi scheme affecting tens of thousands of people in San Pedro, Argentina in late 2024. Seven people linked to that operation were eventually arrested. In the US, the same playbook surfaced in the LSSC scooter-sharing investment scam that became a major federal and state fraud investigation, and a bicycle-sharing investment scam that is actively recruiting victims right now.
Infoblox assesses that unknown threat actors are selling DCloud investment scam templates as kits. There are signs of centralized ownership across a significant chunk of the infrastructure — drops in new domain registrations across diverse hosts suggest a single party either facing disruption or making coordinated changes.
The rogue domains span every continent and target speakers of at least eight languages. They masquerade as major stock exchanges, retail brands, and messaging platforms. A common tactic: invitation-code gates that force prospective victims to be recruited by an existing affiliate, turning each target into a recruiter for the next layer of the pyramid.
Most of the domains are hosted on legitimate providers — Cloudflare, Alibaba Cloud, Tencent Cloud, and AWS. About 6% use bulletproof hosting providers like CTG Server Limited, which has been previously flagged for malicious cyber activity. More sophisticated operators have stripped the default DCloud scaffolding entirely to evade fingerprint-based detection.
The fraudulent operations have been running since mid-2022 and show no signs of slowing down.
