# 236,493 DCloud Uni-App-Built Sites Weaponized in Global Crypto Scam, Wallet-Drainer and Phishing Economy (RainbowEx, LSSC, Yuechi)

> Infoblox threat intelligence identified 236,493 distinct second-level domains built on the legitimate Chinese DCloud Uni-App cross-platform framework being reused as a fraud-as-a-service template for fake crypto exchanges, wallet drainers, pig-butchering investment scams, WhatsApp-lookalike phishing, and pyramid-scheme recruitment sites since mid-2022.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1211
- **ID:** TL-2026-1211
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since mid-2022, threat actors have systematically abused DCloud's legitimate open-source Uni-App cross-platform development framework (Vue.js-based, package prefix `uni.UNI[HEX]`, application class `io.DCloud.application.DCloudApplication`) to mass-produce fraud sites and Android apps. Infoblox's DNS threat-intelligence telemetry logged 236,493 distinct second-level domains carrying DCloud fingerprints, generating 5+ million attempted connections from 985 distinct enterprise customers across 25 industries between January 2024 and mid-2026.

The campaign spans at least eight languages and every continent, with two technical populations: a 'vanilla' tier that retains default DCloud scaffolding (easier to fingerprint and take down) and an 'evasive' tier that strips framework signatures and disproportionately relies on bulletproof hosting (CTG Server Limited, AS152194, Hong Kong; listed on the Spamhaus DROP ASN list) at 2-3x the rate of the vanilla population. The vast majority of domains (~94%) sit on legitimate cloud infrastructure — Cloudflare, Alibaba Cloud, Tencent Cloud, and AWS — to blend with normal traffic and resist takedown.

Monetization templates observed include: fake cryptocurrency exchanges running closed-loop mock trading engines (victims deposit via USDT/stablecoin, see fabricated gains, cannot withdraw); crypto wallet drainers masquerading as BNB Chain/Tether wallet-verification flows; WhatsApp Security-Help-Center phishing kits harvesting credentials; Polymarket-style rigged prediction-market/gambling sites; multi-tier pyramid/MLM investment fronts (electric-scooter and bicycle 'sharing economy' schemes) requiring invitation codes to gate recruitment; and generic brand-impersonation credential-harvest pages (postal services, retail).

Named operations include RainbowEx, a fake Argentine crypto exchange whose collapse triggered a San Pedro, Buenos Aires Province prosecutor's investigation resulting in seven arrests (six in San Pedro, one in Junín) and roughly AR$30M plus $3.5M in USDT seized, with Interpol red notices requested for two Malaysian nationals; Lightning Shared Scooter Co. (LSSC), a US-focused electric-scooter investment pyramid with 8+ physical storefronts across 20+ states, celebrity/official endorsements (including a Sean Spicer Cameo appearance), an FBI Richmond field-office investigation, and a 'New LSSC' successor recruitment drive after collapse; and Yuechi Sharing Technology Ltd. (YST), a scooter/bicycle-sharing investment scam using a real Hong Kong corporate registration (No. 77975280, issued 2025-04-08) and a genuine US FinCEN money-services-business registration (No. 31000300306222, filed 2025-05-15, listed address 125 Deansgate, Manchester UK) as legitimacy props while targeting Australia, New Zealand, and the United States.

Publicity around RainbowEx in October 2024 appears to have acted as a force-multiplier rather than a deterrent: new DCloud-fingerprinted scam-site creation jumped from a few thousand per month to roughly 15,000 per month at peak. Two coordinated infrastructure die-offs (July-September 2025, a roughly two-thirds decline, and a second beginning January 2026) point to centralized control over a meaningful share of the ecosystem despite the presence of many independent, unrelated operators reusing the same commercial scam template. DCloud itself is a legitimate Beijing-based software company with no involvement in the fraud; the abuse is entirely downstream template reuse by criminal operators.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1566 Phishing
- T1684.001 Impersonation
- T1204 User Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1657 Financial Theft
- T1593 Search Open Websites/Domains
- T1598 Phishing for Information
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure
- T1056 Input Capture

## Sources

- [236,000+ DCloud Uni-App Sites Used in Fraud, Phishing, and Crypto Scam Campaigns](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html)
- [From San Pedro to Salinas: How a Chinese Framework (DCloud Uni-App) Powers a Global Scam Economy](https://www.infoblox.com/blog/threat-intelligence/from-san-pedro-to-salinas-how-a-chinese-framework-dcloud-uni-app-powers-a-global-scam-economy/)
- [Infoblox links DCloud app to vast scam website network](https://securitybrief.com.au/story/infoblox-links-dcloud-app-to-vast-scam-website-network)
- [DCloud Uni-App Scam Network Powers RainbowEx-Style Crypto Fraud and WhatsApp Phishing](https://cybersecuritynews.com/dcloud-uni-app-scam-network-powers-rainbowex-style-crypto-fraud/amp/)
- [DCloud Uni-App Framework Powers 236,000+ Scam Domains Across Global Fraud Economy](https://gbhackers.com/dcloud-uni-app-framework/)
- [Chinese Framework Powers 200,000 Scam Sites](https://www.securityweek.com/chinese-framework-powers-200000-scam-sites/)
- [Seven arrested in RainbowEx Ponzi scheme investigation](https://buenosairesherald.com/society/crime/seven-arrested-in-rainbowex-ponzi-scheme-investigation)
- [Argentina Freezes $3.5M USDT Linked to Rainbowex Ponzi Scheme: Report](https://cryptonews.com/news/argentina-freezes-3-5m-usdt-linked-to-rainbowex-ponzi-scheme-report/)
- [RainbowEx scam template scales to 236,493 domains with workplace spillover](https://cybersecasia.net/news/rainbowex-scam-template-scales-to-236493-domains-with-workplace-spillover/)
- [Argentine Prosecutors Arrest 24, Seize Over $8M in USDT in 'Fake Coins' Crypto-Fraud Sweep](https://thedefiant.io/news/regulation/argentine-prosecutors-arrest-24-seize-8m-usdt-fake-coins)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1211