236,000 DCloud Uni-App Sites Fuel Global Crypto Scams and Phishing Operations

Infoblox has uncovered a massive network of over 236,000 websites built using the legitimate Chinese open-source framework DCloud Uni-App, which are being exploited for cryptocurrency scams, phishing, and wallet drainers. The DNS threat intelligence company identified 236,493 distinct second-level domains hosting investment scam templates that power bogus crypto exchanges, pig-butchering operations, WhatsApp phishing networks, fake gambling platforms, brand-impersonation sites, and crypto wallet drainers.

According to Infoblox’s report, unknown threat actors are selling DCloud investment scam templates, with indications of centralized ownership across a significant portion of these sites. The fraudulent operations have been ongoing since mid-2022, with two distinct populations: sites carrying basic DCloud signatures (dating back to 2021) and an investment scam-specific subset active since mid-2022. The latter includes fake cryptocurrency exchanges like the infamous RainbowEx platform, which operated a Ponzi scheme impacting tens of thousands in San Pedro, Argentina, leading to seven arrests in late 2024.

The scam websites span every continent, target speakers of at least eight languages, and impersonate brands from major stock exchanges to retail giants. Common traits include fake brokerage interfaces, cryptocurrency wallet-drainer prompts, gambling interfaces with rigged outcomes, brand-impersonation storefronts, and bulletproof hosting (BPH). Infoblox noted that the investment scam population is larger than the basic DCloud fingerprint reveals, as sophisticated operators strip default scaffolding to evade detection.

Examples of fraudulent schemes include fake cryptocurrency exchanges displaying fictitious trading activity, wallet drainers masquerading as BNB Chain or Tether verification flows, prediction-market impersonations like Polymarket, and WhatsApp phishing using lookalike domains. In the United States, similar playbooks have appeared in the LSSC scooter sharing investment scam and a bicycle sharing scam. The majority of domains are hosted on legitimate providers like Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services, while about 6% use BPH providers like CTG Server Limited (AS152194).