Researchers Map 236,493 DCloud-Built Scam Domains and Linked Fraud Operations
Summary
Infoblox researchers identified 236,493 scam domains built with DCloud Uni-App, spanning fake investment platforms, wallet drainers, phishing and gambling scams. Technical fingerprints, hosting patterns and shared infrastructure point to centralized operators within a.
Key points
- Researchers identified more than 236,000 distinct second-level domains used for fraud since mid-2022, targeting at least eight languages and every continent.
- Scam types include fake crypto exchanges, investment schemes, wallet drainers, gambling impersonations, brand scams and WhatsApp credential phishing.
- DCloud Uni-App is a legitimate framework; its presence alone does not indicate malicious activity. Researchers used additional fingerprints to distinguish scam sites.
- Some operators removed default framework fingerprints. These evasive sites used bulletproof hosting at roughly twice the rate of sites retaining the default scaffolding.
- Shared technical fingerprints and coordinated domain-registration patterns suggest centralized control of portions of the ecosystem, though multiple operators are involved.
- Around 985 enterprise customers generated more than five million DNS queries to the visible scam-domain population, often from low-volume visits consistent with consumer scams reaching work networks.
- Infoblox recommends domain-level DNS blocking and consumer-fraud awareness. The article reports that LSSC sites are offline, while the Yuechi investment operation was active at the time of writing.
Article Details
- Attack Vectors
- Fake cryptocurrency exchanges and investment platforms use fabricated trading activity, accept deposits, and block withdrawals.
- Wallet-drainer sites impersonate cryptocurrency verification flows and drain wallets after users connect.
- Phishing sites impersonate WhatsApp support and other services to collect credentials.
- Scam operators use fake gambling, prediction-market, and brand-impersonation sites.
- Invitation-gated recruitment and referral schemes draw victims into pyramid-style investment scams.
- Scam operators use login and registration forms, messaging, and off-platform customer-service chats to engage victims and direct them to recruiters.
- Defensive Notes
- Use DNS protection to block identified scam domains before users reach the sites.
- Track both DCloud framework fingerprints and scam-specific fingerprints, since some operators remove default framework artifacts.
- Do not treat hosting on a major cloud provider as a sufficient maliciousness signal; assess domains individually.
- Train users on consumer-fraud patterns, including fake investments, wallet drains, and pyramid-style recruitment, rather than focusing only on enterprise-targeted phishing.
- Do not treat government business registrations as vetting or endorsement of an investment operation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | allegro-stroe[.]cc | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | allegro-stroe[.]com | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | allegro-stroe[.]cyou | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | allegro-stroe[.]shop | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | allegroau[.]cc | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | allegroau[.]com | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | aqy[.]dot02ig[.]cfd | Customer-service chat backend run by the Yuechi operation. |
| DOMAIN | bepviews[.]com | DCloud-built wallet-drainer site impersonating BNB Chain verification. |
| DOMAIN | clintile[.]com | Listed as a domain from the DCloud-built scam ecosystem. |
| DOMAIN | correoargentino-comarr[.]top | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | datashareclub[.]com | Listed as a domain from the DCloud-built scam ecosystem. |
| DOMAIN | deepseekpg[.]bet | Listed among DCloud-built prediction-market and gambling scam domains. |
| DOMAIN | energy5[.]cyou | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | faq-whatsapp-center[.]com | DCloud-built WhatsApp phishing template presenting a fake Help Center verification flow. |
| DOMAIN | forwarsprite[.]com | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | futureblockchain[.]net | Listed as a domain from the DCloud-built scam ecosystem. |
| DOMAIN | g3user[.]com | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | hkxiu[.]com | DCloud-built fake investment site impersonating the Hong Kong Gold Exchange. |
| DOMAIN | inetcontrol[.]net | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | jp7[.]com | Listed among DCloud-built prediction-market and gambling scam domains. |
| DOMAIN | k-usdt[.]com | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | kirbycoco[.]cc | Listed as a domain from the DCloud-built scam ecosystem. |
| DOMAIN | lightacer[.]com | Trading platform used by LSSC affiliates for the related Lightning Coin offer; the article says its DCloud use could not be confirmed. |
| DOMAIN | lssc-canada[.]ca | Domain used by the Lightning Shared Scooter Co. scam to target Canadian investors. |
| DOMAIN | lssc[.]ltd | Domain identified as used by the Lightning Shared Scooter Co. investment scam. |
| DOMAIN | lsscapp[.]com | Landing page associated with the Lightning Shared Scooter Co. scam. |
| DOMAIN | lsscol[.]com | Domain used by the Lightning Shared Scooter Co. investment scam. |
| DOMAIN | m0vrsq6[.]top | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | mango-cleopatrapg[.]com | DCloud-built scam gambling site. |
| DOMAIN | mypal[.]pro | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | nasdaqpro[.]top | DCloud-built site impersonating Nasdaq as a fake investment platform. |
| DOMAIN | polymk[.]com | DCloud-built clone of Polymarket identified among scam sites. |
| DOMAIN | rainbowex[.]cc | Website used by the RainbowEx investment scam. |
| DOMAIN | usdtflow[.]net | Listed as a DCloud-built scam domain in the ecosystem indicator list. |
| DOMAIN | verify-what[.]com | Listed among DCloud-built WhatsApp and messaging-platform phishing domains. |
| DOMAIN | whats-zea[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | whats-zef[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | whats-zei[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | whats-zen[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | whats-zrs[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | whats-zus[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | whats-zwp[.]vip | WhatsApp-themed scam domain used in attacks. |
| DOMAIN | xaai3xj[.]com | DCloud-built XAEL-AI investment scam site linked by shared technical and chat infrastructure. |
| DOMAIN | xaaitbb[.]com | DCloud-built XAEL-AI investment scam site linked by shared technical and chat infrastructure. |
| DOMAIN | ys904[.]top | Yuechi scam satellite site presenting an anti-fraud notice. |
| DOMAIN | ystl03106[.]top | Live recruitment platform operated by the Yuechi investment scam, as reported in the article. |
MITRE ATT&CK
People
Brian KrebsPublished an article on scam gambling in July 2025; the article reports an increase in such sites afterward.Danny De HekIndependent investigator who documented being approached by Yuechi recruiters and the operation’s recruitment process.Kyle HoffmanArlington County officer who, working with the FBI’s Richmond field office, estimated total U.S. losses from LSSC were in the millions.Patricia LivingstoneLSSC victim interviewed by NBC News who reported losing approximately $11,000.Sean O’BrienYale Privacy Lab researcher who reviewed the LSSC Android app and shared analysis artifacts with Infoblox researchers.Sean SpicerAppeared to mention LSSC on Cameo; he told NBC News the recording was intended for an individual, not promotional use.Tah-Ming LeeLSSC-affiliated recruiter who said he and his recruits suspected they were communicating with automated chat handlers.
Vendors
Alibaba CloudThe four largest operators visible across the population are Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services, the same hyperscalers that host hundreds of thousands of legitimate businesses.Amazon Web ServicesThe four largest operators visible across the population are Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services, the same hyperscalers that host hundreds of thousands of legitimate businesses.CloudflareThe four largest operators visible across the population are Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services, the same hyperscalers that host hundreds of thousands of legitimate businesses.CTG ServerAnd within that 6%, one provider dominates completely: CTG Server.DCloudand the Telegram-driven price calls, were all built using a Chinese web-developer framework called DCloud Uni-App (DCloud) (en.uniapp[.]dcloud[.]io), an open-source toolkit for building cross-platform mobileTencent CloudThe four largest operators visible across the population are Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services, the same hyperscalers that host hundreds of thousands of legitimate businesses.
Products
BNB ChainThese sites present a “verify your wallet” or “connect your wallet” prompt—sometimes claiming to be official BNB Chain, Tether, or other crypto-platform verification flows—and then drain any wallet that connects.Cash AppInvestors deposited around $2k each by Zelle or Cash App, watched the amount converted into “cryptocurrency” inside the LSSC app, observed fictional daily revenue accumulate, and were eventually unable to withdraw.Lightning CoinLSSC also promoted a related cryptocurrency platform called Lightning Exchange (“Lightning Coin” or LNC), traded through the site lightacer[.]com.Lightning ExchangeLSSC also promoted a related cryptocurrency platform called Lightning Exchange (“Lightning Coin” or LNC), traded through the site lightacer[.]com.PolymarketClones of Polymarket-style prediction markets (Figure 5), or fake casinos and lottery platforms are becoming more common.RainbowExThe platform, called RainbowEx, displayed fictional trading activity, pulled deposits from victims through stablecoin transfers, and blocked withdrawals once the scheme was publicly exposed.Tetherones, present a registration flow typically with an “invite code” to limit signups, accept deposits in Tether or other stablecoins (some even accept Zelle or other traditional payment methods) and display fictionalUni-Appthe Telegram-driven price calls, were all built using a Chinese web-developer framework called DCloud Uni-App (DCloud) (en.uniapp[.]dcloud[.]io), an open-source toolkit for building cross-platform mobileWhatsAppinfrastructure: from RainbowEx-style fake crypto exchanges to multi-language pig-butchering operations, WhatsApp phishing networks, fake gambling platforms, brand-impersonation sites, and crypto wallet drainers.Zellewith an “invite code” to limit signups, accept deposits in Tether or other stablecoins (some even accept Zelle or other traditional payment methods) and display fictional trading activity until the victim attempts to
Tools
Spamhaus DROP ASN listUsing the Spamhaus DROP ASN list, which identifies autonomous systems with high concentrations of malicious activity and bulletproof-hosting characteristics, we flagged approximately 6% of visible DCloud-builtWayback MachineAn archived “How to Get Started with LNC Lightning Coin” tutorial from a now-shuttered LSSC affiliate site (lssc-canada[.]ca), captured by the Wayback Machine.
Countries
ArgentinaFrom Argentina to America: When Scam Sites using DCloud Impact Main StreetAustralia(YST) is currently live, primarily targeting Australia, New Zealand, and the United States, and has invested significant effort in establishing apparent regulatory legitimacy.Canadainvestment scam last year in the U.S., along with a domain used to target Canadian investors, lssc-canada[.]ca.ChinaThe framework is legitimate, widely used in mainland China, and supported by an active developer ecosystem.Hong KongSites in this category often impersonate genuine financial brands: HKEX (Hong Kong Exchanges), Nasdaq, Tesla-themed crypto programs, or generic names like “DawnEX” or “CoinexPro” designed to evoke real exchanges withoutNew Zealand(YST) is currently live, primarily targeting Australia, New Zealand, and the United States, and has invested significant effort in establishing apparent regulatory legitimacy.United KingdomUnited StatesIn the United States, the same playbook has now manifested twice in publicly known operations: first in the LSSC scooter sharing investment scam that scaled into a major federal–and–state fraud investigation last year,
Industries
AgricultureThese customers operate across 25 industry verticals, ranging from the smallest measured exposure (Agriculture, with a single affected customer) to the largest by count (Government, with over 100).Bankingvolume by a wide margin, driven primarily by a single high-volume site (the LSSC scam), followed by Banking, Government, IT Consulting, Education, and Financial Services (Figure 27).Educationprimarily by a single high-volume site (the LSSC scam), followed by Banking, Government, IT Consulting, Education, and Financial Services (Figure 27).Financial Serviceshigh-volume site (the LSSC scam), followed by Banking, Government, IT Consulting, Education, and Financial Services (Figure 27).Food and BeverageFood and Beverage shows the largest aggregate query volume by a wide margin, driven primarily by a single high-volume site (the LSSC scam), followed by Banking, Government, IT Consulting, Education, and FinancialGovernmentThe operators behind Yuechi obtained and prominently display two genuine government registrations:IT Consultingdriven primarily by a single high-volume site (the LSSC scam), followed by Banking, Government, IT Consulting, Education, and Financial Services (Figure 27).