cyber.hendryadrian.com
Security News · securityweek.com

Infoblox Reports More Than 200,000 Scam Websites Use Uni-App Framework

· Original article ↗

Summary

Infoblox reports that more than 200,000 websites use Uni-App-built scam templates, identifying over 236,000 related second-level domains across investment scams, phishing, fake crypto services and other fraud.

Key points

  • Infoblox identified more than 236,000 second-level domains associated with scam infrastructure using the Uni-App framework.
  • The domains support investment scams, fake crypto exchanges, gambling and brand impersonation, phishing, and credential harvesting.
  • Infoblox observed growth since late 2024, with roughly 15,000 newly observed sites per month at peak after October 2024.
  • The sites span multiple hosts and appear to involve multiple operators; Infoblox says coordinated changes may indicate centralized ownership or disruption.
  • RainbowEx, described as a fake cryptocurrency platform, was among the identified schemes; thousands of people in an Argentine town were reportedly duped.
  • Lightning Shared Scooter Co. and Yuechi Sharing Technology Ltd. also used Uni-App frontends; Infoblox links YST to a network of investment-scam sites.
  • The article says Uni-App is widely used for legitimate products and that its maker, DCloud, does not appear involved in the fraudulent use.

Article Details

Event Type
Infoblox reported widespread investment scams using templates built with the Uni-App framework.
Impact
The report identified more than 200,000 websites using investment-scam templates and over 236,000 second-level domains powering scam infrastructure. The sites include fake crypto exchanges, investment platforms, wallet drainers, gambling and prediction-market impersonators, and phishing and credential-harvesting sites. Lightning Shared Scooter Co. likely caused millions of dollars in losses in the United States, according to the article.

Vendors

DCloudWidely used in China and supported by a developer ecosystem, the framework powers thousands of legitimate products, and its maker DCloud does not appear to be involved in its fraudulent use.

Products

RainbowExAmong them is the infamous RainbowEx platform, a fake cryptocurrency platform that made international headlines after thousands of residents of a small Argentine town were duped into pouring money into it.Uni-AppMore than 200,000 websites are using investment scam templates built with the Chinese open source framework Uni-App, Infoblox reports.

Countries

Australia(YST), currently active in Australia, New Zealand, and the United States, also has a frontend built using the Uni-App framework.New Zealand(YST), currently active in Australia, New Zealand, and the United States, also has a frontend built using the Uni-App framework.United States(LSSC), an operation that likely caused millions of dollars in losses in the US, was also using Uni-App.

Industries

CryptocurrencyAmong them is the infamous RainbowEx platform, a fake cryptocurrency platform that made international headlines after thousands of residents of a small Argentine town were duped into pouring money into it.Gamblingsecond-level domains powering the scam infrastructure, ranging from fake crypto exchanges to fake gambling, brand impersonation, WhatsApp phishing, and multi-language pig-butchering websites.