Listen to this Post
236,000+ Scam Websites Exposed as Criminal Networks Abuse DCloud Framework to Fuel Global Crypto Fraud
Introduction
A massive cybercrime ecosystem has been uncovered after security researchers revealed that more than 236,000 fraudulent websites are operating with templates based on the legitimate DCloud Uni-App framework. What was originally designed to simplify cross-platform application development has instead become a favorite tool for cybercriminals building sophisticated cryptocurrency investment scams, phishing portals, fake gambling services, and wallet-draining platforms.
The investigation highlights how legitimate technologies can be weaponized by organized cybercriminal groups at an unprecedented scale. Instead of developing infrastructure from scratch, attackers are reusing professionally designed templates, allowing thousands of convincing scam websites to appear within days while making detection significantly harder for security researchers and law enforcement.
Infoblox Discovers One of the Largest Scam Infrastructures Ever Recorded
Cybersecurity company Infoblox has identified 236,493 unique second-level domains that utilize templates linked to the DCloud Uni-App framework.
According to researchers, fraudulent websites built on these templates have expanded dramatically over the past two years, forming a worldwide infrastructure that targets victims across multiple continents and in numerous languages.
The investigation found that these websites are involved in numerous criminal activities including cryptocurrency investment scams, fake exchanges, WhatsApp phishing campaigns, counterfeit gambling platforms, fake online stores, and cryptocurrency wallet drainers.
Rather than isolated incidents, researchers believe these operations represent an organized criminal ecosystem capable of rapidly deploying new websites whenever older ones are detected or removed.
A Legitimate Development Framework Turned Into a Criminal Tool
DCloud Uni-App itself is not malicious.
It is a legitimate open-source framework widely used by developers to create applications for multiple platforms from a single codebase.
However, cybercriminals have adopted the framework because it provides modern user interfaces that resemble legitimate financial applications.
This enables attackers to quickly clone professional-looking investment portals without spending months developing custom software.
Researchers emphasize that the framework should not be considered malware, but its growing misuse demonstrates how legitimate software can unintentionally become an attractive platform for cybercrime.
Criminal Templates Are Being Sold to Multiple Threat Groups
One of the most significant discoveries in the report is evidence suggesting that pre-built scam templates are likely being sold among different criminal groups.
Researchers observed synchronized registration patterns across thousands of domains hosted on completely different providers.
The coordinated timing indicates that a central supplier may distribute updated templates or infrastructure packages to multiple independent operators.
Several technical fingerprints, hosting choices, communication techniques, and domain registration behaviors all point toward at least partial centralization behind many of these campaigns.
RainbowEx Became One of the Most Notorious Examples
Among the domains identified was the infamous RainbowEx cryptocurrency platform.
The fraudulent exchange became internationally known during late 2024 after operating a large Ponzi-style investment scheme targeting residents of San Pedro, Argentina.
Thousands of victims reportedly lost money before authorities intervened.
Law enforcement later arrested seven individuals connected to the operation, demonstrating that these seemingly anonymous online scams often involve organized criminal networks operating in the real world.
Multiple Categories of Fraud Are Operating Simultaneously
Researchers identified several major categories of fraudulent services built using DCloud templates.
Fake cryptocurrency exchanges convince victims that they are generating profits while preventing withdrawals once significant deposits have been made.
Wallet-draining websites imitate trusted blockchain verification pages and persuade users to connect cryptocurrency wallets, allowing attackers to steal digital assets instantly.
Prediction market clones imitate legitimate services while manipulating every outcome in favor of the operators.
Counterfeit casinos and lottery websites display fabricated winnings designed to encourage additional deposits.
Fake WhatsApp support portals collect user credentials through convincing lookalike domains that imitate official customer support pages.
Simple phishing pages collect usernames, passwords, verification codes, and other sensitive information for resale or additional attacks.
Global Reach Across Multiple Languages
Infoblox reports that these scams are active on virtually every continent.
Victims speaking at least eight different languages have been specifically targeted.
The fraudulent websites impersonate major cryptocurrency exchanges, financial institutions, global retailers, and popular messaging services.
The international scope demonstrates that these operations are no longer regional scams but globally coordinated cybercrime campaigns.
Sophisticated Operators Hide Their Tracks
Researchers divided DCloud-related websites into two broad categories.
The first group includes websites that still retain obvious DCloud signatures, making them easier for investigators to identify.
The second group consists of much more sophisticated operators who deliberately remove identifying framework fingerprints.
These modified websites become significantly harder to detect through automated security systems because they no longer exhibit the default characteristics researchers typically search for.
Ironically, many of the most dangerous scam websites remain hidden precisely because attackers have learned how security companies perform fingerprint analysis.
Pyramid Recruitment Remains Central to Investment Fraud
One common characteristic across many investment scam platforms is the requirement for invitation codes before new users can register.
Victims frequently cannot access investment dashboards unless an existing participant recruits them first.
This recruitment mechanism transforms every victim into a potential promoter.
Friends recruit family members.
Family members recruit coworkers.
Coworkers recruit acquaintances.
This referral structure allows fraudulent investment schemes to spread rapidly while creating social trust that lowers skepticism among new victims.
Customer Support Becomes Another Weapon
Many scam platforms even include customer service systems.
Instead of resolving problems, these support channels convince victims to continue depositing funds whenever withdrawal requests fail.
Victims experiencing frozen accounts, blocked transactions, or registration issues are redirected into branded chat systems where operators maintain the illusion of legitimacy.
Professional customer support has become another psychological manipulation technique used to prolong fraud.
Mainstream Cloud Providers Are Frequently Used
One surprising discovery is that most scam domains are not hosted on obscure servers.
Many operate through respected cloud providers including Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services.
Only a relatively small percentage rely on traditional bulletproof hosting providers specifically known for ignoring abuse complaints.
However, researchers noted that operators who deliberately removed DCloud fingerprints were approximately twice as likely to utilize bulletproof hosting compared to less sophisticated criminals.
This suggests experienced cybercriminals invest heavily in infrastructure that resists takedown efforts.
Criminal Operations Continue to Evolve
The report demonstrates how
Instead of manually creating individual scams, they develop reusable templates, automate deployment, standardize victim recruitment, and continuously improve their infrastructure based on previous successes.
This industrialization allows thousands of fraudulent websites to appear almost overnight while reducing operational costs for attackers.
The result is an expanding underground economy capable of launching highly convincing financial fraud campaigns at an unprecedented scale.
What Undercode Say:
The Infoblox investigation highlights a major shift in cybercrime from isolated phishing campaigns toward industrial-scale scam production.
The most important takeaway is not the number of websites but the reuse of standardized infrastructure.
Criminals are treating fraud as a software business.
Template distribution dramatically lowers technical barriers for new scammers.
One experienced developer can indirectly enable hundreds of criminal groups.
This mirrors ransomware-as-a-service business models.
Legitimate frameworks are becoming attractive attack platforms.
Open-source projects themselves are not responsible.
However, publicly available frameworks simplify mass deployment.
The removal of framework fingerprints demonstrates increasing attacker maturity.
Fingerprint evasion has become routine.
Infrastructure diversity complicates domain blocking.
Cloud hosting provides reliability and scalability.
Mainstream hosting also delays suspicion.
Victims tend to trust professionally designed websites.
Psychological engineering remains more effective than technical exploitation.
Invitation-only registration increases perceived exclusivity.
Referral systems create organic growth.
Customer support extends victim engagement.
Fake profits reinforce trust.
Delayed withdrawals maximize financial losses.
Localized language support increases success rates.
Brand impersonation improves credibility.
Fake exchanges exploit
Wallet drainers bypass traditional banking protections.
Cross-border investigations remain difficult.
Hosting providers alone cannot solve the problem.
Domain registrars also face enormous challenges.
Law enforcement often acts only after large financial losses occur.
Machine learning detection must improve.
Behavioral analysis will become increasingly important.
Infrastructure clustering can reveal criminal relationships.
Threat intelligence sharing is essential.
Organizations should monitor emerging scam templates.
Financial institutions should educate customers continuously.
Users should verify every investment platform independently.
High returns with restricted withdrawals remain classic fraud indicators.
The industrialization of online scams suggests this threat will continue growing unless coordinated international disruption targets both operators and template suppliers.
Deep Analysis: Linux, Windows and macOS Commands for Investigating Suspicious Domains
Linux investigators commonly begin with:
whois suspicious-domain.com dig suspicious-domain.com host suspicious-domain.com nslookup suspicious-domain.com curl -I https://suspicious-domain.com openssl s_client -connect suspicious-domain.com:443 traceroute suspicious-domain.com
Windows administrators may use:
nslookup suspicious-domain.com tracert suspicious-domain.com ping suspicious-domain.com whois suspicious-domain.com
macOS investigators can perform:
dig suspicious-domain.com host suspicious-domain.com networkQuality curl -I https://suspicious-domain.com
Security teams should also monitor SSL certificates, DNS changes, hosting providers, ASN ownership, passive DNS history, and reputation intelligence before interacting with suspicious investment websites.
✅ Verified: Infoblox reported identifying more than 236,000 domains associated with DCloud-based scam infrastructure.
✅ Verified: DCloud Uni-App is a legitimate open-source application development framework and is not inherently malicious. Criminals are abusing it rather than exploiting a vulnerability within it.
✅ Verified: Researchers documented the use of these templates in cryptocurrency investment scams, phishing campaigns, fake exchanges, gambling websites, and wallet-draining operations across multiple countries and languages.
Prediction
(+1) Security vendors will increasingly develop behavioral detection techniques that identify scam infrastructure even after framework fingerprints are removed.
(+1) International cooperation between hosting providers, registrars, and law enforcement will likely improve the speed at which large scam networks are dismantled.
(-1) Criminal groups are expected to continue adopting legitimate development frameworks and cloud infrastructure, making future investment scams more convincing and harder to distinguish from genuine financial platforms.
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
