236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers

Summary: Infoblox identified 236,493 distinct second-level domains running investment scam templates built on DCloud Uni-App, a legitimate Chinese open-source development framework, powering bogus crypto exchanges, pig-butchering operations, WhatsApp phishing, fake gambling platforms, brand-impersonation sites, and wallet drainers. The operations have run since mid-2022, span every continent, target speakers of at least eight languages, and include RainbowEx, the fake exchange behind a Ponzi scheme in San Pedro, Argentina, that led to seven arrests in late 2024.
Key Takeaway: Most of these domains sit on mainstream providers like Cloudflare, Alibaba Cloud, Tencent Cloud, and AWS, while roughly 6% use bulletproof hosting - and the operators careful enough to strip the DCloud fingerprint use BPH at about double the rate, meaning the harder-to-detect scams are also the hardest to take down.

Read the original at The Hacker News ↗

Topics: Fraud & Scams
Related: ArcticRAT Cybercrime Gang Profiles Victim Finances With AI Cyber Risks · Nov 13, 2026
Three People Arrested for AI-Enhanced Impersonation Fraud Cyber Risks · Nov 11, 2026
Medicare scam calls, texts and ads: What to watch for this Open Enrollment Cyber Risks · Oct 14, 2026